Add on-prem installation guide for MCP Gateway (#625)

* docs: add on-prem installation guide for MCP Gateway

New page: permit-mcp-gateway/on-prem-installation.mdx

Customer-facing 7-step installation guide:
1. Extract installer package
2. Push images to customer's registry (load-images.sh)
3. Deploy PDP
4. Configure values (3 inputs: platform URL, domain, Keycloak password)
5. Helm install
6. Configure TLS
7. Verify (10 pods, 2 ingresses)

Also covers: external database, storage, email, cross-cluster,
upgrading, and troubleshooting (gateway restarts, login loop,
invalid credentials, CreateContainerConfigError).

Added link from enterprise-deployment.mdx to the new installation guide.
Added to sidebar after enterprise-deployment.

* docs: complete customer journey from tar.gz to running deployment

Gaps fixed:
- Added Docker and private registry to prerequisites
- Added "Information you'll need" table (Permit API key, namespace, etc.)
- Added package contents tree after extraction (Step 1)
- Step 2: explicit registry auth command before load-images.sh
- Step 3: clarified PDP API key source (Permit dashboard) and
  PERMIT_BACKEND_INTERNAL_URL (in-cluster DNS for permit-backend-v2)
- Added Step 6: DNS setup (create A records for wildcard + app domain)
- Step 7 (was 6): TLS — unchanged
- Step 8 (was 7): Verify — added browser check for login page
- Added "Checking logs" section to troubleshooting

* docs: clarify PDP URL usage — needed in helm values AND Platform UI host creation

Explains that the PDP URL is used in two places:
1. Helm values (global.permit.pdpUrl) for consent-service
2. Platform UI when creating each MCP host (per-request authorization)

Added table showing internal K8s DNS vs external URL options.
Added tip about multiple PDPs for different hosts/environments.

* docs: PDP URL is per-host (Platform UI), not global helm value

Removed pdpUrl from helm values example. PDP URL is configured per-host
in the Platform UI when creating a host — both gateway and consent-service
read it from the same source (gateway Admin API).

* docs: align on-prem installation guide with actual implementation

- Add egress requirements section (no external cloud dependencies)
- Fix email config: SMTP only (Mailgun blocked in on-prem mode)
- Add Keycloak secret reference option (Option A recommended)
- Add missing nginx.enabled and full OIDC config to values example
- Remove --atomic flag (can tear down StatefulSets on failure)
- Move TLS secret creation before helm install (auth needs HTTPS)
- Add troubleshooting: install failure, migration errors, OIDC secret timing
- Simplify prerequisites to the 3 real inputs needed
- Add --create-namespace to helm install command

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: improve on-prem installation guide for production readiness

Add security warning for plaintext passwords, health check smoke test,
helm rollback guidance, DNS wildcard note, and minor clarifications
for cross-cluster setup and namespace creation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: EliMoshkovich

docs/permit-mcp-gateway/enterprise-deployment.mdx

@@ -104,6 +104,8 @@ The fully on-premises deployment is designed to operate in **air-gapped environm
 - **Self-contained updates** — software updates are delivered as versioned artifacts (container images, binaries) that can be transferred into the air-gapped environment via your existing secure media processes.
 - **Local audit storage** — all audit logs, consent records, and session data are stored within your infrastructure. No data is transmitted externally.
 
+Ready to install? See the [On-Prem Installation Guide](/permit-mcp-gateway/on-prem-installation) for step-by-step setup.
+
 ### When to Choose Fully On-Premises
 
 This deployment model is designed for environments where external connectivity is not an option: