[PF-3384] feat(helm): support Google IAP on the GKE ingress

[genisd]

Summary

Adds an optional Google Identity-Aware Proxy layer at the GKE ingress so every request must carry a Google identity at the load balancer, before reaching optio pods. Optio's own application login is untouched. Design doc: docs/superpowers/specs/2026-07-10-iap-ingress-design.md.

Changes

• values: new ingress.gke.iap.enabled flag (default off), documented in values.yaml and values.production.yaml with the one-time GCP setup steps (OAuth redirect URI + iap.httpsResourceAccessor grant)
• templates: new iap-secret.yaml renders <release>-iap-oauth with the client_id/client_secret keys IAP requires, sourced from the existing auth.google.* values; render fails if IAP is enabled without them
• backend-config: both web and api BackendConfigs gain an iap block referencing that secret

Note: with IAP enabled, external unauthenticated callers (/api/webhooks/*, /api/hooks/*, Slack events) are blocked — accepted trade-off, no bypass backend.

Testing

helm template render checks: IAP block on both BackendConfigs when enabled, absent when disabled, secret has correct keys, clean failure without google creds; production values still render; helm lint passes.

• Tests pass (pnpm turbo test)
• Typechecks pass (pnpm turbo typecheck)

Related

Rollout runbook: docs/superpowers/plans/2026-07-10-iap-ingress.md (Task 3)