feat(k8s): publish the portals through the labs Caddy (refs #177)

Adds a `keycloakUrl` chart value: when set, it replaces host + Keycloak's
NodePort as the pinned issuer and the portals' OIDC authority, so the stack
works behind the existing *.labs.respellion.tech Caddy over HTTPS. Empty keeps
today's behaviour. The deploy workflow passes the KEYCLOAK_URL repo variable.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infra/helm/big-reference/templates/_helpers.tpl

@@ -135,6 +135,14 @@ cluster-internal hosts ({{ .Release.Namespace }}) and the node address
 {{- end }}
 {{- end -}}
 
+{{/*
+The origin a browser reaches Keycloak on: the issuer Keycloak pins and the
+authority the portals use, from one place so they cannot drift (ADR-0010).
+*/}}
+{{- define "big.keycloakUrl" -}}
+{{- .Values.keycloakUrl | default (printf "http://%s:%v" .Values.host (index .Values.nodePorts "keycloak")) -}}
+{{- end -}}
+
 {{- define "big.labels" -}}
 app.kubernetes.io/name: {{ .name }}
 app.kubernetes.io/instance: {{ .root.Release.Name }}