cleanup: Remove obsolete port-forwarding, deferred Traefik files, and CI workaround

- Remove ansible/roles/private-access/ (replaced by Tailscale LB services)
- Remove deferred observability ingress/traefik files (replaced by direct Tailscale LBs)
- Remove orphaned kustomization-traefik-config.yaml (no backing directory)
- Simplify CI: remove SA patch + job deletion workaround for rancher-backup
  (now handled by postRenderer in HelmRelease)
- Update AGENTS.md to reflect current architecture

ansible/roles/private-access/tasks/main.yml

@@ -1,86 +0,0 @@
----
-- name: Create systemd unit for Grafana private access
-  template:
-    src: kubectl-port-forward.service.j2
-    dest: /etc/systemd/system/k8s-portforward-grafana.service
-    mode: "0644"
-  vars:
-    unit_description: Port-forward Grafana for Tailscale access
-    unit_namespace: observability
-    unit_target: svc/observability-kube-prometheus-stack-grafana
-    unit_local_port: 13080
-    unit_remote_port: 80
-
-- name: Create systemd unit for Prometheus private access
-  template:
-    src: kubectl-port-forward.service.j2
-    dest: /etc/systemd/system/k8s-portforward-prometheus.service
-    mode: "0644"
-  vars:
-    unit_description: Port-forward Prometheus for Tailscale access
-    unit_namespace: observability
-    unit_target: svc/observability-kube-prometh-prometheus
-    unit_local_port: 19090
-    unit_remote_port: 9090
-
-- name: Create systemd unit for Flux UI private access
-  template:
-    src: kubectl-port-forward.service.j2
-    dest: /etc/systemd/system/k8s-portforward-flux-ui.service
-    mode: "0644"
-  vars:
-    unit_description: Port-forward Flux UI for Tailscale access
-    unit_namespace: flux-system
-    unit_target: svc/flux-system-weave-gitops
-    unit_local_port: 19001
-    unit_remote_port: 9001
-
-- name: Create systemd unit for Rancher HTTP private access
-  template:
-    src: kubectl-port-forward.service.j2
-    dest: /etc/systemd/system/k8s-portforward-rancher.service
-    mode: "0644"
-  vars:
-    unit_description: Port-forward Rancher HTTP for Tailscale access
-    unit_namespace: cattle-system
-    unit_target: svc/cattle-system-rancher
-    unit_local_port: 19442
-    unit_remote_port: 80
-
-- name: Create systemd unit for Rancher HTTPS private access
-  template:
-    src: kubectl-port-forward.service.j2
-    dest: /etc/systemd/system/k8s-portforward-rancher-https.service
-    mode: "0644"
-  vars:
-    unit_description: Port-forward Rancher HTTPS for Tailscale access
-    unit_namespace: cattle-system
-    unit_target: svc/cattle-system-rancher
-    unit_local_port: 19443
-    unit_remote_port: 443
-
-- name: Reload systemd
-  systemd:
-    daemon_reload: true
-
-- name: Enable and start private access port-forward services
-  systemd:
-    name: "{{ item }}"
-    enabled: true
-    state: started
-  loop:
-    - k8s-portforward-grafana.service
-    - k8s-portforward-prometheus.service
-    - k8s-portforward-flux-ui.service
-    - k8s-portforward-rancher.service
-    - k8s-portforward-rancher-https.service
-
-- name: Configure Tailscale Serve for private access endpoints
-  shell: >-
-    tailscale serve reset &&
-    tailscale serve --bg --tcp={{ private_access_grafana_port }} tcp://127.0.0.1:13080 &&
-    tailscale serve --bg --tcp={{ private_access_prometheus_port }} tcp://127.0.0.1:19090 &&
-    tailscale serve --bg --tcp={{ private_access_flux_port }} tcp://127.0.0.1:19001 &&
-    tailscale serve --bg --tcp={{ private_access_rancher_port }} tcp://127.0.0.1:19442 &&
-    tailscale serve --bg --tcp=9443 tcp://127.0.0.1:19443
-  changed_when: true

ansible/roles/private-access/templates/kubectl-port-forward.service.j2

@@ -1,13 +0,0 @@
-[Unit]
-Description={{ unit_description }}
-After=network-online.target k3s.service
-Wants=network-online.target
-
-[Service]
-Type=simple
-Restart=always
-RestartSec=5
-ExecStart=/usr/local/bin/kubectl -n {{ unit_namespace }} port-forward --address 127.0.0.1 {{ unit_target }} {{ unit_local_port }}:{{ unit_remote_port }}
-
-[Install]
-WantedBy=multi-user.target