Routing alignment notes (staging/prod)

Summary
- Root (/) issues a 301 redirect to /admin/ via server-snippet on the apps ingress.
- Prefixes /admin, /api, /chat-client are stripped at the edge and forwarded to their backends on /. The applications do not need to be prefix-aware.
- /verify remains available (Prefix) without any rewrite in a separate Ingress.
- No CORS annotations at ingress. Static assets are served by Bunny CDN; API CORS is not handled here.
- /flower is intentionally NOT exposed on k8s.

Files
- ingress-https.yaml: NGINX Ingress (apps) with regex paths and rewrite-target to strip prefixes; includes server-snippet to 301 redirect root to /admin/.
- ingress-verify.yaml: Separate Ingress for /verify without regex/rewrite.

Paths behavior
- / -> 301 /admin/
- /admin/<...> -> eveai-app-service:80, backend receives /<...>
- /api/<...> -> eveai-api-service:80, backend receives /<...>
- /chat-client/<...> -> eveai-chat-client-service:80, backend receives /<...>
- /verify[/**] -> verify-service:80, path preserved.

Notes
- The rewrite-target is global per Ingress. To avoid affecting /verify, we split it into its own Ingress. Keep this structure when adding/removing services.
- If you need temporary legacy redirects (e.g., /client -> /chat-client), add an additional Ingress with nginx.ingress.kubernetes.io/permanent-redirect and regex matching, or handle it at the app/CDN layer.