chore: repo cleanup and updates

[DeJayDev]

Adds support for auth-v2 and fixes a bug with how we render out Azure Foundry settings.

Also:

• Standardizes model provider env vars as PLATFORM_API_KEY and PLATFORM_BASE_URL. Existing users, no change is required
• Ships and enables "auth v2". Existing users, the migration is in docs/operations.md
• Makes Redis a non optional dependency, running Valkey by default.
• Rewrites some documentation

[greptile-apps]

Confidence Score: 5/5

The latest changes appear safe to merge, with no outstanding blocking or non-blocking findings.

Summary

• Adds a NetworkPolicy separating access to Hydra’s public and admin ports.
• Preserves auth-v2 access through matching release and component labels.
• Keeps kubelet readiness checks on the permitted public port.
• The three previous findings are no longer outstanding because their threads were resolved.

_{Reviews (4) · Last reviewed commit: "fix: lockdown hydra admin endpoint"}

[greptile-apps-staging]

Confidence Score: 5/5

No blocking failure remains.

What we checked:

• I inspected the Hydra policy, port values, and component labels, then ran a rendered-policy reachability test against HEAD^ and the current revision.
• Before applying the NetworkPolicy, the pre-change test showed that no Hydra NetworkPolicy existed and an ordinary same-namespace workload could reach TCP/4445.
• After applying the changes, the current exercise showed that a same-namespace workload is denied TCP/4445, an auth-v2 workload is allowed TCP/4445, and both workloads can reach TCP/4444, confirming the administrative endpoint restriction is active.
• I inspected the Kubernetes manifests to confirm the policy rendering; deployment-hydra.yaml selects Hydra pods, the 4444 ingress is open, and 4445 is restricted to pods matching the release selector labels plus app.kubernetes.io/component: auth-v2.
• I captured the exact rendered policy and all probes, including the before and after states, and confirmed the capture exited with code 0.

Summary

• This update adds the Auth v2 and Hydra deployment resources, bundles Valkey as a standard dependency, preserves compatibility for model-provider configuration, and expands deployment documentation.
• The two earlier reports that Hydra’s administrative API was reachable by ordinary in-cluster workloads are disproved by an executed policy exercise. The rendered policy denies ordinary same-namespace workloads access to TCP/4445, permits the release’s auth-v2 pods to reach that port, and leaves the public TCP/4444 endpoint reachable.

_{Reviews (3) · Last reviewed commit: "fix: lockdown hydra admin endpoint"}