Phase 8.14 — Retiring nginx as the ingress layer

Every route on the platform currently passes through a single shared ingress-nginx controller, configured globally. That sharing has already caused real, visible bugs: a setting meant for one application applied platform-wide because there was no way to scope it to just that route.

This phase replaces that shared, globally-configured layer with a routing model where each application's rules stand on their own instead of leaning on one global configuration everyone quietly depends on. The exact replacement — the Kubernetes Gateway API standard, or Traefik as a more direct drop-in — has not been decided yet; that choice is the first thing this phase settles before any traffic actually moves.

What this phase does

• Evaluates Gateway API and Traefik as the replacement for ingress-nginx and picks one.
• Migrates routes across in stages, verified one at a time rather than in a single cutover.
• Removes the global configuration surface that let one app's settings leak onto every other app.

No visible impact intended — this changes how traffic is routed internally, not what any service's URL or behaviour looks like from outside.