Replace live-E2E Nginx and ingress-nginx assumptions with the shared Pingora edge

[seonghobae]

Current protected-branch migration defects

develop still contains two active Nginx-owned deployment/test paths:

1. docker-compose.live-e2e.yml runs an nginx:1.27-alpine service, mounts tests/live/nginx.conf, and publishes the full live-E2E product through 127.0.0.1:18080:8080.
2. k8s/ingress.yaml contains nginx.ingress.kubernetes.io/rewrite-target: /, coupling Kubernetes routing behavior to ingress-nginx.

These are ACTIVE_DEPLOYMENT/TEST_RUNTIME evidence after the organization Pingora edge policy was merged.

Domain ownership

Naruon owns the product route contract (/api -> backend, / -> frontend), browser-origin/CORS expectations, authentication/session behavior and its deployment acceptance tests. ContextualWisdomLab/pingora-gateway owns only reusable edge transport. Keep Naruon route semantics in a Naruon deployment/edge adapter; do not move product routes into the shared gateway repository.

Shared-runtime dependency

Do not reference an invented Pingora tag/image/digest. Migrate the live-E2E service only after pingora-gateway has a real reviewed artifact/image or intentionally stack a source-consumer contract test against a versioned unpublished package without claiming deployment completion.

RED characterization required

Before replacement, run the current live-E2E Nginx path and preserve:

• /api rewrite/proxy behavior to backend;
• / and frontend asset behavior;
• Host/forwarded-header/client-origin behavior relevant to auth and CORS;
• streaming/request-body behavior used by current endpoints;
• browser navigation and API calls through the published 18080 origin;
• error/status behavior for missing frontend and backend routes;
• startup/readiness/termination behavior expected by the current test harness.

Kubernetes decision

Do not replace the annotation with another controller-specific string. Determine the correct topology: a Pingora Deployment/Service (and, if appropriate, a standards-based Gateway API integration) versus an external managed ingress. Preserve the public route contract, NetworkPolicy/TLS ownership, readiness/drain and rollback. If the cluster ingress is provider-managed rather than CWL-managed, document that authority rather than forcing Pingora into the provider boundary.

DDD/path correction

Once migration is protected-shipped, remove the obsolete tests/live/nginx.conf and Nginx-named deployment paths. The replacement configuration belongs under Naruon's edge/deployment bounded responsibility, while route semantics remain product-owned and Pingora-specific transport types stay behind the adapter.

GREEN acceptance

• live E2E no longer launches Nginx;
• no ingress-nginx-specific annotations remain where CWL owns the routing runtime;
• current Naruon browser/API/auth/CORS behavior passes through the replacement edge;
• non-root/read-only-root, resource limits, liveness/readiness, graceful drain and rollback are tested;
• deployment/architecture/security/operability docs and docs/product-technical-gap-baseline.md are current;
• exact-head CI/security/coverage/SBOM/provenance evidence passes on the unchanged migration head.