Routing alignment notes (staging/prod)

Summary
- Root (/) redirect will be handled at Bunny (edge). No server-snippet is used in the ingress.
- Prefixes /admin, /api, /chat-client are stripped at the ingress and forwarded to their backends on /. The applications do not need to be prefix-routed internally.
- For consistent external URLs (especially after POST/redirect), each prefix Ingress injects X-Forwarded-Prefix via nginx.ingress.kubernetes.io/proxy-set-headers and a per-prefix ConfigMap.
- /verify remains available (Prefix) without any rewrite in a separate Ingress.
- No CORS annotations at ingress. Static assets are served by Bunny CDN; API CORS is not handled here.
- /flower is intentionally NOT exposed on k8s.

Files
- ingress-admin.yaml: Ingress for /admin with regex paths, rewrite-target to strip prefix, and proxy-set-headers pointing to eveai-admin-headers.
- ingress-api.yaml: Ingress for /api with regex paths, rewrite-target to strip prefix, and proxy-set-headers pointing to eveai-api-headers.
- ingress-chat-client.yaml: Ingress for /chat-client with regex paths, rewrite-target to strip prefix, and proxy-set-headers pointing to eveai-chat-headers.
- headers-configmaps.yaml: ConfigMaps defining X-Forwarded-Prefix per ingress.
- ingress-https.yaml: Legacy combined ingress retained for reference; server-snippet removed. Consider deprecating once split ingresses are applied.
- ingress-verify.yaml: Separate Ingress for /verify without regex/rewrite.

Paths behavior
- / -> 301 /admin/
- /admin/<...> -> eveai-app-service:80, backend receives /<...>
- /api/<...> -> eveai-api-service:80, backend receives /<...>
- /chat-client/<...> -> eveai-chat-client-service:80, backend receives /<...>
- /verify[/**] -> verify-service:80, path preserved.

Notes
- The rewrite-target is global per Ingress. To avoid affecting /verify, we split it into its own Ingress. Keep this structure when adding/removing services.
- If you need temporary legacy redirects (e.g., /client -> /chat-client), add an additional Ingress with nginx.ingress.kubernetes.io/permanent-redirect and regex matching, or handle it at the app/CDN layer.