feat(ops): conditional vanity route deployment

[DerekRoberts]

Introduces an optional Vanity URL OpenShift route that only deploys if vanity_url is populated. It leaves the default route untouched, allowing consumers to safely pilot GitHub Secrets-driven TLS.

New Features & Safety Rails

• Isolated Vanity Template: The route is deployed via a completely decoupled openshift.vanity-route.yml template, ensuring primary PROD routes are insulated from vanity config errors.
• Cryptographic Validation (Fail-Fast): Uses openssl in the pipeline to mathematically validate that the private key matches the certificate before talking to OpenShift. Prevents garbage secrets from breaking live routes.
• Automated Archival Backups: Implements a "Snapshot Before Replace" system. Prior to deploying, the pipeline extracts the currently working certificates from OpenShift and archives them into a secure, append-only OpenShift Secret. This prevents accidental GitHub Secret overwrites from permanently destroying valid certificates.
• Local Developer Validation: Includes scripts/validate_tls_pair.sh to allow developers to pre-verify certificates locally.
• Documentation: Usage guide added to README.md.

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[Copilot]

Pull request overview

Adds support for an optional “vanity URL” OpenShift Route for the frontend that is only deployed when a vanity_url input is provided, enabling TLS material to be injected from GitHub Secrets while leaving the default route unchanged.

Changes:

• Introduces a new OpenShift Template to create a secondary frontend Route with edge TLS using provided certificate material.
• Extends the reusable GitHub Actions deploy workflow to accept a vanity_url input plus TLS-related secrets.
• Conditionally deploys the vanity route during the frontend matrix deployment when vanity_url is non-empty.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
frontend/openshift.vanity-route.yml	New OpenShift template for a secondary (vanity) frontend Route with injected TLS fields.
.github/workflows/reusable-deploy.yml	Adds inputs/secrets and a conditional deployment step to apply the vanity route template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.