feat(site-publish): add split-surface publishing

Authored-By: OpenAI (GPT-5) <noreply@openai.com>

templates/ingress.yaml.j2

@@ -1,12 +1,10 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ site_k8s }}
+  name: {{ route.resource_name }}
   namespace: {{ namespace }}
-{%- if site_type != "docker" %}
   annotations:
-    traefik.ingress.kubernetes.io/router.middlewares: https-redirect@file,retry-upstream@file{% for m in middlewares %},{{ m }}@file{% endfor %}
-{%- endif %}
+    traefik.ingress.kubernetes.io/router.middlewares: https-redirect@file,retry-upstream@file{% if route.access_middleware %},{{ route.access_middleware }}@file{% endif %}{% for m in route.middlewares %},{{ m }}@file{% endfor %}
 spec:
   ingressClassName: traefik
   tls:
@@ -20,22 +18,22 @@ spec:
   - host: {{ domain }}
     http:
       paths:
-      - path: /
+      - path: {{ route.path }}
         pathType: Prefix
         backend:
           service:
-            name: {{ site_k8s }}
+            name: {{ route.resource_name }}
             port:
               number: 80
 {%- for alias in aliases %}
   - host: {{ alias }}
     http:
       paths:
-      - path: /
+      - path: {{ route.path }}
         pathType: Prefix
         backend:
           service:
-            name: {{ site_k8s }}
+            name: {{ route.resource_name }}
             port:
               number: 80
 {%- endfor %}

templates/kustomization.yaml.j2

@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- service.yaml
-- ingress.yaml
+{% for route_file in route_files -%}
+- {{ route_file }}
+{% endfor -%}
 - certificate.yaml

templates/service.yaml.j2

@@ -1,11 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ site_k8s }}
+  name: {{ route.resource_name }}
   namespace: {{ namespace }}
+{%- if not compatibility %}
+  annotations:
+    traefik.ingress.kubernetes.io/service.passhostheader: "false"
+{%- endif %}
 spec:
   type: ExternalName
-  externalName: garage.storage.svc.k8s.sjc001.fritzlab.net
+  externalName: {{ route.artifact_config.website_authority }}
   ports:
   - port: 80
     targetPort: 80