cleanup: Remove obsolete port-forwarding, deferred Traefik files, and CI workaround

- Remove ansible/roles/private-access/ (replaced by Tailscale LB services)
- Remove deferred observability ingress/traefik files (replaced by direct Tailscale LBs)
- Remove orphaned kustomization-traefik-config.yaml (no backing directory)
- Simplify CI: remove SA patch + job deletion workaround for rancher-backup
  (now handled by postRenderer in HelmRelease)
- Update AGENTS.md to reflect current architecture

.gitea/workflows/deploy.yml

@@ -304,11 +304,8 @@ jobs:
           kubectl -n flux-system wait --for=condition=Ready kustomization/addon-ccm --timeout=600s
           kubectl -n flux-system wait --for=condition=Ready kustomization/addon-csi --timeout=600s
           kubectl -n flux-system wait --for=condition=Ready kustomization/addon-tailscale-operator --timeout=300s
-          # Observability stack deferred - complex helm release timing out, debug separately
-          # kubectl -n flux-system wait --for=condition=Ready kustomization/addon-observability --timeout=300s
-          # kubectl -n flux-system wait --for=condition=Ready kustomization/addon-observability-content --timeout=300s
 
-      - name: Wait for Rancher and fix backup operator
+      - name: Wait for Rancher and backup operator
         env:
           KUBECONFIG: outputs/kubeconfig
         run: |
@@ -320,15 +317,6 @@ jobs:
           echo "Waiting for rancher-backup operator..."
           kubectl -n flux-system wait --for=condition=Ready kustomization/addon-rancher-backup --timeout=600s || true
 
-          echo "Patching default SA in cattle-resources-system..."
-          kubectl patch serviceaccount default -n cattle-resources-system -p '{"automountServiceAccountToken": false}' || true
-
-          echo "Cleaning up failed patch-sa jobs..."
-          kubectl delete job -n cattle-resources-system rancher-backup-patch-sa --ignore-not-found=true || true
-
-          echo "Force reconciling rancher-backup HelmRelease..."
-          flux reconcile helmrelease rancher-backup -n flux-system --timeout=5m || true
-
       - name: Restore Rancher from latest B2 backup
         env:
           KUBECONFIG: outputs/kubeconfig