Enable ingress basic auth for remote test contour.

Protect all public URLs via nginx basic auth; exempt Gitea API/registry/git paths for CI.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/backend/values.yaml

@@ -17,6 +17,11 @@ ingress:
   className: nginx
   host: api.test.sova.local
   tls: false
+  basicAuth:
+    enabled: false
+    secretName: contour-basic-auth
+    realm: "Sova Test Contour"
+    skipLocations: "/.well-known/acme-challenge"
 
 resources:
   php: