feat(manifests): retarget hcmais overlay for ambient-ui deployment (#1634)

## Summary

- Replace `jsell-sso-poc` sub-overlay with a clean `hcmais` overlay
targeting `ambient-api` namespace
- Deploys only: ambient-api-server, DB, control-plane, ambient-ui,
postgresql
- Adds ambient-ui Route + SSO env patch for Keycloak on HCMAIS ROSA
cluster
- Updates ambient-ui deploy skill with HCMAIS deployment steps and
prerequisites

## Prerequisites (manual, before applying)

1. Keycloak client `ambient-ui` in `ambient-code` realm (already
created)
2. `sso-credentials` secret in `ambient-api` namespace (already created)
3. `ambient-control-plane-token` secret (already exists)

## Deploy

```bash
kustomize build components/manifests/overlays/hcmais | oc apply -n ambient-api -f -
```

## Test plan

- [x] `kustomize build overlays/hcmais` produces valid YAML
- [x] Output contains exactly 5 deployments: ambient-api-server,
ambient-api-server-db, ambient-control-plane, ambient-ui, postgresql
- [x] Routes: ambient-ui + api-server with correct hostnames
- [x] ambient-ui env has SSO_REDIRECT_URI, preview hosts, API_SERVER_URL
- [ ] Dry-run against cluster: `oc apply --dry-run=server`
- [ ] ambient-ui pod starts, `/api/healthz` returns 200
- [ ] SSO login redirects to Keycloak and back

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
  * Updated OpenShift routes and service targets for ambient UI and API.
* Adjusted container environment variables for UI, API server, and
control plane to production values.
* Removed JSell SSO PoC overlay and associated secrets, RBAC, config,
and PVC resources.
* Enhanced deployment documentation with HCMAIS environment and
Keycloak/SSO setup guidance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jsell-rh

…so-poc/ambient-api-server-env-patch.yaml …hcmais/ambient-api-server-env-patch.yamlcomponents/manifests/overlays/hcmais/jsell-sso-poc/ambient-api-server-env-patch.yaml renamed to components/manifests/overlays/hcmais/ambient-api-server-env-patch.yaml components/manifests/overlays/hcmais/jsell-sso-poc/ambient-api-server-env-patch.yaml renamed to components/manifests/overlays/hcmais/ambient-api-server-env-patch.yaml

@@ -10,7 +10,5 @@ spec:
           env:
             - name: AMBIENT_ENV
               value: production
-            - name: BACKEND_URL
-              value: "http://backend-service.jsell-ambient-sso-poc.svc:8080"
             - name: JWK_CERT_URL
               value: "https://keycloak-ambient-keycloak.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com/realms/ambient-code/protocol/openid-connect/certs"

components/manifests/overlays/hcmais/ambient-ui-env-patch.yaml

@@ -0,0 +1,14 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ambient-ui
+spec:
+  template:
+    spec:
+      containers:
+        - name: ambient-ui
+          env:
+            - name: SSO_REDIRECT_URI
+              value: "https://ambient-ui-ambient-api.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com/api/auth/sso/callback"
+            - name: NEXT_PUBLIC_PREVIEW_ALLOWED_HOSTS
+              value: "*.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com,*.openshiftapps.com"

…hcmais/jsell-sso-poc/frontend-route.yaml …ts/overlays/hcmais/ambient-ui-route.yamlcomponents/manifests/overlays/hcmais/jsell-sso-poc/frontend-route.yaml renamed to components/manifests/overlays/hcmais/ambient-ui-route.yaml components/manifests/overlays/hcmais/jsell-sso-poc/frontend-route.yaml renamed to components/manifests/overlays/hcmais/ambient-ui-route.yaml

@@ -1,17 +1,14 @@
 apiVersion: route.openshift.io/v1
 kind: Route
 metadata:
-  name: frontend-route
-  labels:
-    app: frontend
+  name: ambient-ui
 spec:
+  host: ambient-ui-ambient-api.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com
   to:
     kind: Service
-    name: frontend-service
-    weight: 100
+    name: ambient-ui-service
   port:
     targetPort: http
   tls:
     termination: edge
     insecureEdgeTerminationPolicy: Redirect
-  wildcardPolicy: None

…mais/jsell-sso-poc/api-server-route.yaml …ts/overlays/hcmais/api-server-route.yamlcomponents/manifests/overlays/hcmais/jsell-sso-poc/api-server-route.yaml renamed to components/manifests/overlays/hcmais/api-server-route.yaml components/manifests/overlays/hcmais/jsell-sso-poc/api-server-route.yaml renamed to components/manifests/overlays/hcmais/api-server-route.yaml

@@ -1,16 +1,14 @@
 apiVersion: route.openshift.io/v1
 kind: Route
 metadata:
-  name: ambient-api-server-route
+  name: ambient-api-server
 spec:
-  host: ambient-api-server-jsell-ambient-sso-poc.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com
+  host: ambient-api-server-ambient-api.apps.rosa.hcmais01ue1.s9m2.p3.openshiftapps.com
   to:
     kind: Service
     name: ambient-api-server
-    weight: 100
   port:
-    targetPort: 8000
+    targetPort: api
   tls:
     termination: edge
     insecureEdgeTerminationPolicy: Redirect
-  wildcardPolicy: None

components/manifests/overlays/hcmais/control-plane-env-patch.yaml

@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ambient-control-plane
+spec:
+  template:
+    spec:
+      containers:
+        - name: ambient-control-plane
+          env:
+            - name: AMBIENT_API_SERVER_URL
+              value: "http://ambient-api-server.ambient-api.svc:8000"
+            - name: AMBIENT_GRPC_SERVER_ADDR
+              value: "ambient-api-server.ambient-api.svc:9000"
+            - name: AMBIENT_GRPC_USE_TLS
+              value: "false"
+            - name: CP_TOKEN_URL
+              value: "http://ambient-control-plane.ambient-api.svc:8080/token"
+            - name: AMBIENT_API_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: ambient-control-plane-token
+                  key: token