Vault OIDC login via Authentik: hostAlias + blueprint config

Vault's OIDC auth method needs to resolve auth.kube.huskypup.net (the
issuer URL) from inside its own pod - no in-cluster DNS entry exists for
that public hostname, so add a hostAlias pointing at the live
istio-ingressgateway LoadBalancer IP (verified current: 172.28.101.244).

authentik-blueprints-vault (vault-blueprint.yaml) was already applied to
the cluster and referenced by the authentik Deployment for some time -
committing it now so git matches the live, working state instead of
leaving it as an untracked local file.

infrastructure/vault/values.yaml

@@ -21,6 +21,11 @@ server:
           disable_hostname = true
         }
 
+  hostAliases:
+    - ip: "172.28.101.244"
+      hostnames:
+        - auth.kube.huskypup.net
+
   standalone:
     enabled: false