feat(k8s): publish the portals through the labs Caddy (refs #177)

Adds a `keycloakUrl` chart value: when set, it replaces host + Keycloak's
NodePort as the pinned issuer and the portals' OIDC authority, so the stack
works behind the existing *.labs.respellion.tech Caddy over HTTPS. Empty keeps
today's behaviour. The deploy workflow passes the KEYCLOAK_URL repo variable.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

infra/helm/big-reference/templates/deployments.yaml

@@ -28,7 +28,7 @@ spec:
       {{- range $w.files }}
       {{- if hasPrefix "portal-config-" .configMap }}
       annotations:
-        checksum/portal-config: {{ printf "%s|%v" $.Values.host (index $.Values.nodePorts "keycloak") | sha256sum }}
+        checksum/portal-config: {{ include "big.keycloakUrl" $ | sha256sum }}
       {{- end }}
       {{- end }}
       labels: