feat: add private network ingress management

[TristanSpeakEasy]

Why

AIS-604 needs a safe management surface for an organization to configure private network ingress before provider reconciliation and traffic serving are enabled. This checkpoint adds that desired-state API while keeping rollout fail-closed and credentials out of API and audit payloads.

Linear: AIS-604

Depends on #5895.

What changed

• Added organization-scoped create, read, update, credential rotation, health-check, delete-impact, and delete operations, with generated Goa/OpenAPI/dashboard SDK contracts.
• Added encrypted provider credential persistence, deterministic provider resource identities, transaction-serialized lifecycle changes, audit/outbox events, and safe tombstone/retry behavior.
• Added two expansion gates: the network_ingress product entitlement and an organization-targeted PostHog rollout flag. Reads, explicit disable-only updates, and deletion remain available if rollout is later withdrawn.
• Wired network-mode admission into MCP and meta-MCP writes, requiring an enabled ingress while preserving public-only recovery.
• Prevented deletion of a custom domain while an active ingress is pinned to it, and exposed the entitlement in staff and platform-admin feature controls.

Review notes

• Focus on the admission matrix and mutation safety in server/internal/networkingress/, especially post-commit signaling and disable/delete behavior after gate removal.
• Provider-specific credentials and naming are isolated behind the provider field/resource helpers so future providers can add implementations without changing the public lifecycle model.
• The startup reconcile signaler is intentionally nil in this checkpoint; AIS-611 will supply the provider workflow client. checkHealth therefore fails safely until that integration lands.
• Generated OpenAPI and dashboard SDK files account for most of the diff.

Testing

• mise lint:server — passed (sandbox emitted a non-fatal Go module stat-cache permission warning).
• mise build:server — passed.
• mise run test:server ./internal/networkingress ./internal/customdomains ./internal/productfeatures ./internal/mcpservers ./internal/metamcp ./internal/admin ./internal/urn -count=1 — 1,315 tests passed natively; sandbox could not access the Colima Docker socket.
• mise run test:server ./internal/networkingress -count=1 — passed after one transient Redis I/O timeout during a parallel focused run.
• mise run lint:webhooks-server — passed; one additive, non-breaking event.
• Admin/dashboard type-checks, focused feature/audit tests, and oxlint — passed.
• git diff --check — passed.
• Cubic review — two findings addressed (duplicate checker and cross-domain repository coupling); follow-up pass reached the provider deadline without findings.

Rollout / deployment notes

• New ingress expansion remains disabled unless both the product entitlement and PostHog organization rollout flag are enabled.
• No provider infrastructure is provisioned by this PR; AIS-611 supplies reconciliation and health signaling.

---

Summary by cubic

Implements AIS-604 with organization-scoped Tailscale private network ingress management and Kubernetes provisioning support. Network-mode MCP and meta-MCP writes now require a live, enabled ingress, re-checked inside the write transaction via a sealed admission finalizer whose zero value fails closed; expansion remains fail-closed unless both the network_ingress entitlement and organization rollout flag are enabled.

New Features

• Adds create, get, update, credential rotation, delete-impact, delete, and health-check APIs with generated Goa, OpenAPI, and dashboard SDK contracts.
• Create and rotation accept OAuth client ID and secret only; credentials are encrypted and excluded from API responses, audit records, outbox events, and workflow arguments.
• Adds deterministic Tailscale resource naming, per-ingress attestor identity validation, lifecycle audit/outbox events, tombstone cleanup, and custom-domain deletion protection.
• Serializes lifecycle operations with an organization advisory lock so concurrent creates and create-vs-cleanup races cannot interleave.
• Pins OAuth challenges and grants to the ingress surface while preserving reads, disable-only updates, deletion, and recovery to public_only after gate removal.
• The reconciliation signaler remains unset until AIS-611, so health checks fail safely and this PR does not provision provider infrastructure.

^{Written for commit b906a5c. Summary will update on new commits.}

[linear-code]

AIS-604

[changeset-bot]

⚠️ No Changeset found

Latest commit: b906a5c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cubic-dev-ai]

Running ultrareview automatically — This adds a new network-ingress lifecycle API with encrypted credentials, entitlement-gated admission control in MCP/meta-MCP writes, and custom-domain deletion safeguards—subtle bugs here could break access control or leak credentials, so it warrants a deep review.. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 12m 26s

All reported issues were addressed across 91 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 25 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 5 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>