feat: move GitLab from EKS to EC2 (docker-compose on IDE instance)

## Overview

Move GitLab out of the EKS hub cluster onto the same EC2 instance that hosts the code-server IDE, managed via docker-compose. **Reuses the existing CloudFront distribution and Caddy reverse proxy** — no new NLB or CloudFront distribution needed. GitLab owns `/`, code-server moves to `/ide`. `user1` created with the same workshop password, no SSO.

## Approach: single CloudFront + Caddy path routing

The IDE already has: EIP → CloudFront → Caddy (port 80) → code-server (port 8111).

New Caddyfile:
```
http://${domain} {
# GitLab CE at root
handle /* {
reverse_proxy 127.0.0.1:8929
}
}

http://${domain}/ide* {
uri strip_prefix /ide
handle @proxy { ... } # existing /proxy/ handler
handle /* {
reverse_proxy 127.0.0.1:8111
}
}
```

code-server works under a subpath with `uri strip_prefix` only — no flags needed on the binary itself (confirmed from code-server docs). GitLab CE at root avoids the Beta subpath limitation entirely.

## Branch strategy

- **GitHub (appmod-blueprints)**: `feature/cloudfront-on-agent-platform-without-gitlab` → PR #755 targeting `feature/cloudfront-on-agent-platform`
- **GitLab (platform-engineering-on-eks)**: `feat/pr-709-kind-crossplane-gitlab-on-ec2` → MR !321 targeting `feat/pr-709-kind-crossplane`

---

## Changes — GitLab repo (platform-engineering-on-eks / CDK)

### A. `cdk/lib/team-stack.ts` — minimal changes only

- Remove NLB (`GitlabNlb`, `GitlabTg`, `GitlabListener`), CloudFront distribution (`GitlabDistribution`), and SG rule — all unnecessary
- Keep `GitTokenSeed` Lambda CR: seeds `git_token = ide_password` into `-hub/secrets` at deploy time
- Keep `CfnOutput GitlabUrl` — value is now `https://${ide.accessUrl}` (same domain)
- Pass `GITLAB_CF_DOMAIN` via `cdk.Fn.sub` = `gitlabDistribution.distributionDomainName` → replaced by existing `ide` CF domain token

### B. `cdk/resources/bootstrap.sh`

- Install Docker + docker-compose v2
- Write `docker-compose.yml` for `gitlab/gitlab-ce`: listens on `127.0.0.1:8929`, `external_url 'https://${GITLAB_CF_DOMAIN}'`
- **Rewrite Caddyfile**: GitLab at `/`, code-server at `/ide`, existing `/proxy` handler preserved
- Start GitLab: `docker compose up -d`
- Write `private/gitlab-cloudfront-domain` = `${GITLAB_CF_DOMAIN}` (same domain as IDE)
- Write `private/gitlab-ec2-private-ip` for ArgoCD in-cluster git access

### C. `cdk/lib/team-stack.ts` — summary

| Change | Detail |
|---|---|
| **Remove** NLB + CloudFront + SG rule | Not needed — reuse IDE CloudFront |
| Keep `GitTokenSeed` Lambda CR | Seeds `git_token` at deploy time |
| `CfnOutput GitlabUrl` | `ide.accessUrl` (same domain, root path) |
| `GITLAB_CF_DOMAIN` in `Fn.Sub` | Use IDE domain token directly |

---

## Changes — GitHub repo (appmod-blueprints)

### D. Disable GitLab ArgoCD addon
- `gitops/overlays/environments/control-plane/enabled-addons.yaml`: `gitlab: false`
- `gitops/addons/registry/platform.yaml`: remove gitlab ApplicationSet
- `platform/infra/terraform/hub-config.yaml`: `enable_gitlab: false`

### E. Remove Keycloak SSO client for GitLab
- `gitops/addons/charts/keycloak/templates/keycloak-config.yaml`: remove `gitlab-client-payload` + `create_client` + `add_client_scope` calls

### F. Remove NLB/CloudFront Taskfile tasks for GitLab
- `cluster-providers/kind-crossplane/Taskfile.cloudfront.yaml`: remove `gitlab-nlb`, `gitlab-distribution`, sync-origins GitLab block, `setup-exposure` refs

### G. Simplify Taskfile install flow
- `cluster-providers/kind-crossplane/Taskfile.yaml`:
- Replace k8s Job wait with GitLab readiness poll
- Add `gitlab:init-ec2` task (curl-based init: root token, user1, repos)
- `GITLAB_DOMAIN_INT` → EC2 private IP for in-cluster ArgoCD git pulls
- Remove `git_token` from `seed-secrets`

### H. Update workshop content IDE URL references
- All content references to the IDE URL must add the `/ide` suffix

---

## Design decisions

| Decision | Choice |
|---|---|
| CloudFront | Reuse existing IDE CloudFront (EIP-based) |
| Routing | Caddy: `/` → GitLab:8929, `/ide` → code-server:8111 |
| GitLab subpath | Avoided (Beta status, asset recompile overhead) |
| code-server subpath | Works cleanly via `uri strip_prefix` (no binary flags needed) |
| GitLab deployment | docker-compose on EC2 (independent of kind cluster lifecycle) |
| In-cluster git access | EC2 private IP (same VPC, no CF round-trip) |
| `git_token` | Seeded by CDK Lambda CR at deploy time |

## Files touched

| Repo | File |
|---|---|
| GitLab | `cdk/lib/team-stack.ts` |
| GitLab | `cdk/resources/bootstrap.sh` |
| GitLab | Workshop content (IDE URL → /ide) |
| GitHub | `gitops/overlays/environments/control-plane/enabled-addons.yaml` |
| GitHub | `gitops/addons/registry/platform.yaml` |
| GitHub | `gitops/addons/charts/keycloak/templates/keycloak-config.yaml` |
| GitHub | `cluster-providers/kind-crossplane/Taskfile.cloudfront.yaml` |
| GitHub | `cluster-providers/kind-crossplane/Taskfile.yaml` |
| GitHub | `platform/infra/terraform/hub-config.yaml` |

Start with cdk/lib/team-stack.ts and cdk/resources/bootstrap.sh, then trace the listed Taskfiles and GitOps manifests in the appmod-blueprints repository. Verify the EC2 docker-compose deployment, Caddy routing, disabled Kubernetes GitLab integration, private-IP access, initialization flow, and updated /ide workshop links against the issue’s stated design.

Written by the indexing model from the issue text.