api.lux.financial answers, so the admin console can sign in

The console at admin.lux.financial builds absolute URLs against this
host -- const zm="https://api.lux.financial" in its bundle, with no
same-origin path to proxy -- so it rendered and could not sign in while
nothing named the host.

app.lux.financial deliberately did not get this: dashd proxies /v1 to
this Service inside the cluster, so the dash works without the bank's
API being published. That is why it was routed first and alone, and why
this is a separate decision recorded separately.

What this publishes was read off the running pod, not assumed:
/v1/bank/health and /v1/bank/config answer 200, /v1/bank/overview 401,
and /api/collections -- the Base admin surface underneath bankd -- 404.
The framework's own console is not reachable through this route.

Co-authored-by: Hanzo AI <[email protected]>

deploy/lux-bank/bankd.yaml

@@ -93,3 +93,22 @@ topologySpread:
 lifecycle: null
 terminationGracePeriodSeconds: 30
 defaultReadinessProbe: false
+
+# api.lux.financial. The admin console at admin.lux.financial builds absolute
+# URLs against this host -- `const zm="https://api.lux.financial"` in its bundle,
+# with no same-origin path to proxy -- so the console renders and cannot sign in
+# until this answers. app.lux.financial does NOT need it: dashd proxies /v1 to
+# this Service inside the cluster, which is why that host was routed first and
+# alone.
+#
+# What is published, checked against the running pod rather than assumed:
+# /v1/bank/health and /v1/bank/config answer 200, /v1/bank/overview answers 401,
+# and /api/collections -- the Base admin surface underneath -- answers 404. The
+# framework's own console is not reachable through this route; only the bank's
+# API is.
+ingress:
+  enabled: true
+  hosts:
+  - api.lux.financial
+  tls: true
+  className: ingress