feat(plane-enterprise): support OpenShift's restricted-v2 SCC and Route ingress - #289

The TLS options sections were Traefik-only: the table's Entrypoint column does
not apply to `ingressClass: nginx`, and nothing said what ssl.externalTermination
does there -- yet an ALB or nginx-ingress holding the certificate is exactly the
common nginx case.

Adds a matching note to both charts: options 2 and 3 emit the Ingress `tls:`
block as before, option 4 emits none and only sets the URL scheme. Includes a
rendered example, verified against both charts.

Also records the pre-existing, TLS-unrelated render failure on that path:
ingress.ingress_annotations ships commented out and templates/ingress.yaml calls
`len` on it, so `ingressClass: nginx` dies with "len of nil pointer" unless at
least one annotation is set. Present in both charts; #289 fixes the
plane-enterprise copy, so it is only documented here, with the workaround,
rather than patched twice.

plane-enterprise goes to 3.4.1 so the new section actually ships -- chart-releaser
runs with skip_existing, so a docs change under charts/ without a version bump is
silently never republished.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

templates/ingress.yaml called `len` on ingress.ingress_annotations, which ships
commented out, so `ingressClass: nginx` failed outright with
"error calling len: len of nil pointer" on default values -- the nginx path was
unusable unless you happened to set an annotation.

Switches to `{{- with }}`, which skips a nil/empty map cleanly. Same one-line
change in both charts, so the nginx TLS guidance added in this PR describes a
path that actually renders.

Picked up from #296, which made this fix for plane-ce; #289 makes the identical
change to the plane-enterprise copy, so that hunk may conflict trivially.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…EB_URL scheme (#300)

* fix(plane-ce): stop forcing TLS on the Traefik ingress, and fix WEB_URL scheme

Ports #295 to plane-ce, which carried the same Traefik defect plus a second,
worse one of its own.

templates/ingress-traefik.yaml hardcoded HTTPS in all three IngressRoutes -- the
app, the MinIO console and the RabbitMQ console. Each pinned the `websecure`
entrypoint and emitted its `tls:` block outside any conditional, so a default
install (tls_secret_name empty, generateCerts/createIssuer false) had no HTTP
listener AND no certificate: the routes advertised <release>-ssl-cert, a Secret
that templates/certs/certs.yaml only creates when createIssuer and generateCerts
are both true. Traefik answers such a handshake with its built-in self-signed
certificate, logs nothing and stays Ready, which is why this went unnoticed.

config-secrets/app-env.yaml then hardcoded WEB_URL as "http://<appHost>"
regardless of ssl.*, so even a correctly TLS-configured install served Plane over
HTTPS while telling the app it lived at http://. Unlike plane-enterprise, whose
WEB_URL was at least conditional, this affected the *working* configurations too.

Adds the same three helpers and keeps each setting to one job:

  plane.chartManagedCert -> `tls:` block + entrypoint
  plane.tlsEnabled       -> https:// scheme for WEB_URL
  entryPoints            -> entrypoint override

plus ssl.externalTermination for TLS terminated in front of Plane, and
ingress.traefik.entryPoints for renamed entrypoints or the Traefik-terminated
case. The nginx Ingress path already gated its `tls:` block and is untouched
beyond picking up the WEB_URL fix.

Render diff against master, all three routes and both ingress classes:
  nothing set                  -> 2 IngressRoutes differ (the fix)
  tls_secret_name              -> only WEB_URL differs
  generateCerts+createIssuer   -> only WEB_URL differs
  nginx, nothing set           -> no change
  nginx, tls_secret_name       -> only WEB_URL differs

README gains the TLS options section with a snippet per option, the 4a/4b
distinction, an nginx note, and an upgrade note covering both behaviour changes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs: document the nginx TLS path on both charts

The TLS options sections were Traefik-only: the table's Entrypoint column does
not apply to `ingressClass: nginx`, and nothing said what ssl.externalTermination
does there -- yet an ALB or nginx-ingress holding the certificate is exactly the
common nginx case.

Adds a matching note to both charts: options 2 and 3 emit the Ingress `tls:`
block as before, option 4 emits none and only sets the URL scheme. Includes a
rendered example, verified against both charts.

Also records the pre-existing, TLS-unrelated render failure on that path:
ingress.ingress_annotations ships commented out and templates/ingress.yaml calls
`len` on it, so `ingressClass: nginx` dies with "len of nil pointer" unless at
least one annotation is set. Present in both charts; #289 fixes the
plane-enterprise copy, so it is only documented here, with the workaround,
rather than patched twice.

plane-enterprise goes to 3.4.1 so the new section actually ships -- chart-releaser
runs with skip_existing, so a docs change under charts/ without a version bump is
silently never republished.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: render the nginx Ingress with default (unset) annotations

templates/ingress.yaml called `len` on ingress.ingress_annotations, which ships
commented out, so `ingressClass: nginx` failed outright with
"error calling len: len of nil pointer" on default values -- the nginx path was
unusable unless you happened to set an annotation.

Switches to `{{- with }}`, which skips a nil/empty map cleanly. Same one-line
change in both charts, so the nginx TLS guidance added in this PR describes a
path that actually renders.

Picked up from #296, which made this fix for plane-ce; #289 makes the identical
change to the plane-enterprise copy, so that hunk may conflict trivially.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(plane-enterprise): bump to 3.4.2 for the nginx fix and TLS docs

The earlier bump in this branch was a no-op: #299 had already taken 3.4.1, so
the version matched master and chart-releaser (skip_existing) would have silently
declined to republish -- leaving the nginx annotations fix and the TLS/nginx
documentation unshipped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(plane-ce): fix doubled word in the ssl.externalTermination table row

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>