fix(helm): honor empty clientCaSecretName for HTTPS-only mode

[lunarwhite]

Summary

Fix a Helm chart bug where server.tls.clientCaSecretName="" was documented as HTTPS-only mode but the chart still rendered client_ca_path in gateway.toml and mounted the tls-client-ca volume when built-in PKI or cert-manager shared-CA paths were active. The gateway then required client certificates, causing browser ERR_BAD_SSL_CLIENT_AUTH_CERT failures on direct TLS + OIDC setups.

Introduce a shared openshell.gatewayClientCaEnabled predicate so an explicit empty value disables client-CA wiring in both the ConfigMap and the gateway workload, overriding built-in PKI and cert-manager defaults.

Related Issue

Fixes #2095

Changes

• Add openshell.gatewayClientCaEnabled helper; use it in gateway-config.yaml and _gateway-workload.tpl for TOML, volume, and volumeMount
• Treat server.tls.clientCaSecretName="" as an explicit HTTPS-only opt-out before PKI/cert-manager fallbacks
• Fail fast when server.tls.clientCaSecretName is set to null (chart expects "" or omit the key)
• Add Helm regression tests for TOML omission (built-in PKI, cert-manager shared CA, cert-manager without shared CA) and StatefulSet volume omission
• Document HTTPS-only + OIDC configuration in docs/kubernetes/access-control.mdx and docs/reference/gateway-config.mdx

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)
• Manual kind cluster verification with --set server.tls.clientCaSecretName="": no client_ca_path in ConfigMap, no tls-client-ca volume, gateway logs omit "TLS client certificate verification enabled"; upgrade path verified

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[TaylorMutch]

We don't need to reference the helm chart here.

[lunarwhite]

Removed. Thanks for your review!

[TaylorMutch]

Looks good overall. Helm unit tests (69/69), lint, and an HTTPS-only render all pass.

One follow-up: please update .agents/skills/debug-openshell-cluster/SKILL.md to note that clientCaSecretName: "" intentionally omits the client-CA config and volume, with authentication provided by OIDC or a trusted proxy. Repository instructions require this skill update for gateway deployment changes.

[lunarwhite]

One follow-up: please update .agents/skills/debug-openshell-cluster/SKILL.md to note that clientCaSecretName: "" intentionally omits the client-CA config and volume, with authentication provided by OIDC or a trusted proxy. Repository instructions require this skill update for gateway deployment changes.

Great suggestion. Added into a separate commit for easy review: 47199bd