Enable ingress basic auth for remote test contour.

Protect all public URLs via nginx basic auth; exempt Gitea API/registry/git paths for CI.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/backend/values-test.yaml

@@ -4,6 +4,8 @@ ingress:
     enabled: true
     clusterIssuer: letsencrypt-prod
     secretName: backend-tls
+  basicAuth:
+    enabled: true
 image:
   tag: backend-v1.0.12-test
   pullPolicy: IfNotPresent