Fix Open WebUI auth: correct WEBUI_SECRET_KEY and remove Ollama config

- WEBUI_SECRET_KEY now uses dedicated webui-secret-key (not vllm-api-key)
- ExternalSecret updated to fetch webui_secret_key from 1Password
- Remove duplicate OLLAMA_BASE_URLS configuration (vLLM only)

cluster/applications/open-webui/deployment.yaml

@@ -37,11 +37,10 @@ spec:
           valueFrom:
             secretKeyRef:
               name: body-wars-secret
-              key: vllm-api-key
+              key: webui-secret-key
               optional: false
-        # Backend configuration for vLLM
-        - name: OLLAMA_BASE_URLS
-          value: "http://astro-orbiter:8000"
+        # Backend configuration for vLLM (OpenAI-compatible, NOT Ollama)
+        # OLLAMA_BASE_URLS removed: astro-orbiter runs vLLM, not Ollama
         - name: OPENAI_BASE_URL
           value: "http://astro-orbiter:8000/v1"
         - name: OPENAI_API_KEY

cluster/applications/open-webui/externalsecret.yaml

@@ -18,9 +18,15 @@ spec:
       engineVersion: v2
       data:
         vllm-api-key: "{{ .vllm_api_key }}"
+        webui-secret-key: "{{ .webui_secret_key }}"
   data:
     # vLLM API key from 1Password (mk-labs vault, vllm item, api-key field)
     - secretKey: vllm_api_key
       remoteRef:
         key: vllm
         property: api-key
+    # WebUI JWT signing secret from 1Password (mk-labs vault, open-webui item, secret-key field)
+    - secretKey: webui_secret_key
+      remoteRef:
+        key: open-webui
+        property: secret-key

cluster/platform/astro-orbiter-gateway/externalname-service.yaml

@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: astro-orbiter
+  namespace: default
+  labels:
+    app.kubernetes.io/name: astro-orbiter-gateway
+    app.kubernetes.io/component: llm-inference
+spec:
+  type: ExternalName
+  externalName: 10.1.71.130
+  ports:
+  - name: vllm-8000
+    port: 8000
+    protocol: TCP
+  - name: llama-cpp-8001
+    port: 8001
+    protocol: TCP
+  - name: router-8002
+    port: 8002
+    protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: astro-orbiter-vllm
+  namespace: default
+  labels:
+    app.kubernetes.io/name: astro-orbiter-gateway
+    app.kubernetes.io/component: llm-inference
+spec:
+  type: ExternalName
+  externalName: 10.1.71.130
+  ports:
+  - name: vllm
+    port: 8000
+    protocol: TCP