fix(platform): move gateway and namespace into manifests/ directory

cluster/platform/gateway-api/manifests/gateway.yaml

@@ -1,23 +1,29 @@
 # ------------------------------------------------------------------------------
+# GatewayClass — tells Kubernetes that Cilium handles Gateway resources
+# Defined here alongside the Gateway it enables
+# ------------------------------------------------------------------------------
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: cilium
+spec:
+  controllerName: io.cilium/gateway-controller
+  description: Cilium Gateway API implementation (eBPF-native)
+
+---
+# ------------------------------------------------------------------------------
 # Gateway — fastpass-gateway
-# Wave 5.5 — after cilium-config (4) and ingress-nginx (5)
 #
 # This is the central Gateway that all HTTPRoute resources attach to.
 # Cilium operator creates a LoadBalancer service for this Gateway automatically,
 # which will receive an IP from the cilium-gateway-pool (10.1.71.90-.99).
 #
-# Listeners:
-#   - HTTP  (port 80)  — redirect to HTTPS or direct for internal services
-#   - HTTPS (port 443) — TLS termination via cert-manager certificates
-#   - TCP   (port configurable) — for non-HTTP services (future use)
-#
 # Usage: Applications create HTTPRoute resources that reference this Gateway:
 #
 #   spec:
 #     parentRefs:
 #       - name: fastpass-gateway
 #         namespace: gateway-system
-#
 # ------------------------------------------------------------------------------
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
@@ -25,22 +31,16 @@ metadata:
   name: fastpass-gateway
   namespace: gateway-system
   annotations:
-    # Request a specific IP from the cilium-gateway-pool
     io.cilium/lb-ipam-ips: "10.1.71.90"
 spec:
   gatewayClassName: cilium
   listeners:
-    # HTTP listener — accepts from all namespaces
     - name: http
       protocol: HTTP
       port: 80
       allowedRoutes:
         namespaces:
           from: All
-
-    # HTTPS listener — TLS termination
-    # Each service provides its own cert via cert-manager Certificate resource
-    # and a ReferenceGrant allowing the Gateway to read it cross-namespace
     - name: https
       protocol: HTTPS
       port: 443
@@ -50,8 +50,5 @@ spec:
       tls:
         mode: Terminate
         certificateRefs:
-          # ArgoCD TLS cert — first service on the Gateway
-          # Add additional certs here as services are added, or use
-          # a wildcard cert (*.local.mk-labs.cloud) once the pattern is proven
           - name: argocd-tls
             namespace: argocd

cluster/platform/gateway-api/manifests/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gateway-system
+  labels:
+    kubernetes.io/metadata.name: gateway-system

cluster/platform/gateway-api/namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gateway-system
-  labels:
-    # Allow all namespaces to attach Routes to Gateways in this namespace
-    kubernetes.io/metadata.name: gateway-system