[BUG] Restore Helm-configured controller authentication end to end #2968

controller.auth.mode and controller.auth.userIdClaim need to work end to end in the shipped Helm deployment. Setting trusted-proxy currently does not select ProxyAuthenticator: the controller calls app.Run(ctx, app.Options{}), which selects UnsecureAuthenticator. Using another authenticator requires a custom library integration through app.Options.Authenticator.

The chart previously rendered these values into environment variables that the controller does not consume:

#2967 removes these ineffective settings as part of the environment-variable cleanup. This issue tracks restoring them together with the controller wiring and end-to-end tests.

Reproduction

On the chart before #2967, configure oauth2-proxy with an OIDC provider and set:

controller:
  auth:
    mode: trusted-proxy
    userIdClaim: email

The chart emits AUTH_MODE=trusted-proxy and AUTH_USER_ID_CLAIM=email, but the shipped controller still uses UnsecureAuthenticator. Browser sign-in does not activate controller authentication or make it use the configured identity claim. This finding comes from the source audit; the deployed flow needs regression coverage.

Expected behavior and acceptance criteria

• Restore the Helm values and render KAGENT_AUTH_MODE and KAGENT_AUTH_USER_ID_CLAIM, following the naming convention introduced in refactor: standardize environment settings and generate their reference #2967. Consume them in controller startup, selecting ProxyAuthenticator through the existing app.Options.Authenticator boundary. A standard Helm installation should not require a custom controller binary.
• Preserve unsecure as the default and reject unsupported mode values at startup instead of silently falling back to it.
• Pass the configured user-ID claim to ProxyAuthenticator. Cover the default sub claim, a custom claim such as email, the existing fallback to sub when the custom claim is absent, and rejection when no usable identity exists.
• Add E2E coverage using the shipped controller, rendered chart, oauth2-proxy, and a test OIDC provider. Verify that sign-in produces the expected controller caller identity through the UI/nginx API path, authenticated API/MCP requests and agent invocation work, and missing or malformed credentials are rejected on protected controller endpoints. Include a regression check for default unsecure behavior.
• Exercise invalid/expired credential rejection at the proxy and document the required ingress/network isolation. ProxyAuthenticator decodes claims without validating JWT signatures or expiry, so the deployment must preserve the trusted-proxy boundary.
• Register the restored settings in go/core/pkg/env, regenerate docs/env.md, and update the Helm and OIDC deployment documentation with a working configuration.

Relevant code and documentation:

• Controller entrypoint
• Application options and defaults
• ProxyAuthenticator
• OIDC proxy authentication