chore: purge sentinel-v5 references

Author: BK1031

infra/environments/prod/foundry.tf

@@ -44,8 +44,8 @@
 #         record, writes CNAME → <tunnel-id>.cfargotunnel.com within
 #         its --interval (1m default).
 #      d. Traffic starts landing on foundry within CF TTL.
-#   5. Bake. Add each remaining hostname (sentinel-v5 / mapache / vault)
-#      in a follow-up PR — copy gr-prod/manifests/<svc>/ into
+#   5. Bake. Add each remaining hostname (mapache / vault) in a
+#      follow-up PR — copy gr-prod/manifests/<svc>/ into
 #      gr-foundry/manifests/<svc>/ with two file changes (ingress.yaml →
 #      Traefik + external-dns annotation, postgres.yaml → public
 #      hostname). No terraform edit needed.

infra/environments/prod/main.tf

@@ -210,7 +210,8 @@ resource "cloudflare_dns_record" "gr_clickhouse" {
 # Cloudflare allows one entrypoint ruleset per (zone, phase). The
 # argocd rule was originally created via the dashboard, which Cloudflare
 # stores as an http_config_settings ruleset under the hood. We import
-# that existing ruleset and add the sentinel-v5 rule alongside it.
+# that existing ruleset and manage the remaining per-hostname rules
+# alongside it.
 resource "cloudflare_ruleset" "ssl_overrides" {
   zone_id = data.cloudflare_zone.gauchoracing.id
   name    = "Per-hostname SSL overrides"
@@ -227,15 +228,6 @@ resource "cloudflare_ruleset" "ssl_overrides" {
         ssl = "strict"
       }
     },
-    {
-      description = "sentinel-v5-strict-mode"
-      expression  = "(http.host eq \"sentinel-v5.gauchoracing.com\")"
-      action      = "set_config"
-      enabled     = true
-      action_parameters = {
-        ssl = "strict"
-      }
-    },
     {
       description = "mapache-strict-mode"
       expression  = "(http.host eq \"mapache.gauchoracing.com\")"

infra/modules/argocd/variables.tf

@@ -19,7 +19,7 @@ variable "domain" {
 variable "oidc_issuer" {
   description = "OIDC issuer for SSO. Must byte-match Sentinel's ISSUER and the iss claim in its tokens."
   type        = string
-  default     = "https://sentinel-v5.gauchoracing.com"
+  default     = "https://sso.gauchoracing.com"
 }
 
 variable "oidc_client_id" {