feat(datastore): implement structured personal data layer (ADR 0004, ForwardAuth /family, and OpenClaw protocol)

k8s/minio/hosting-ingress.yaml

@@ -7,6 +7,7 @@ spec:
   addPrefix:
     prefix: /hosting
 ---
+# Public Ingress for hosting.haumdaucher.de (Recipes, Public Assets)
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -16,6 +17,7 @@ metadata:
     kubernetes.io/ingress.class: "traefik"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     kubernetes.io/tls-acme: "true"
+    traefik.ingress.kubernetes.io/router.priority: "10"
     traefik.ingress.kubernetes.io/router.middlewares: minio-hosting-add-prefix@kubernetescrd
 spec:
   ingressClassName: traefik
@@ -34,3 +36,34 @@ spec:
   - hosts:
     - hosting.haumdaucher.de
     secretName: hosting-haumdaucher-de-tls
+---
+# Protected Ingress for /family (Family Dashboards, Nutrition & Sleep Analytics)
+# Protected by Authentik ForwardAuth
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: minio-hosting-family
+  namespace: minio
+  annotations:
+    kubernetes.io/ingress.class: "traefik"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    kubernetes.io/tls-acme: "true"
+    traefik.ingress.kubernetes.io/router.priority: "100"
+    traefik.ingress.kubernetes.io/router.middlewares: auth-authentik-forwardauth@kubernetescrd,minio-hosting-add-prefix@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: hosting.haumdaucher.de
+    http:
+      paths:
+      - path: /family
+        pathType: Prefix
+        backend:
+          service:
+            name: minio
+            port:
+              number: 9000
+  tls:
+  - hosts:
+    - hosting.haumdaucher.de
+    secretName: hosting-haumdaucher-de-tls