Add ServiceEntry for wildcard host to fix Kiali KIA0104

The global-authentik-authz AuthorizationPolicy uses *.kube.huskypup.net
as a host match, but Kiali flagged KIA0104 because the wildcard had no
matching entry in Istio's service registry. Adding a MESH_EXTERNAL
ServiceEntry with resolution NONE registers the hostname without
affecting routing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/istio/manifests/mesh/authentik-allow.yaml

@@ -65,3 +65,23 @@ spec:
 
             # --- Vault (has its own auth system + API access by ESO/apps) ---
             - "vault.kube.huskypup.net"
+
+---
+# Register the wildcard hostname in Istio's service registry so that the
+# AuthorizationPolicy host reference above passes Kiali KIA0104 validation.
+# MESH_EXTERNAL + resolution NONE = no routing side-effects; this is purely
+# a registry entry for the wildcard used in the CUSTOM policy above.
+apiVersion: networking.istio.io/v1
+kind: ServiceEntry
+metadata:
+  name: kube-huskypup-net-wildcard
+  namespace: istio-system
+spec:
+  hosts:
+    - "*.kube.huskypup.net"
+  location: MESH_EXTERNAL
+  resolution: NONE
+  ports:
+    - number: 443
+      name: https
+      protocol: HTTPS