feat: optional site.yaml 'middlewares' list appended to Ingress middleware annotation

Lets a site opt into extra file-provider middlewares (e.g. authentik-forwardauth
to auth-gate a site). Backward-compatible: absent/empty key renders the exact
previous annotation.

scripts/deploy.py

@@ -126,6 +126,7 @@ def render_site_manifests(site_name, action_dir, app_dir, manifests_dir, cfg):
         "domain": cfg["domain"],
         "aliases": cfg["aliases"],
         "namespace": NAMESPACE,
+        "middlewares": cfg["middlewares"],
     }
     render_templates(action_dir, template_vars, app_dir, manifests_dir)
 

scripts/utils.py

@@ -87,6 +87,10 @@ def parse_site_yaml(site_dir):
     if not isinstance(excludes, list) or any(not isinstance(p, str) for p in excludes):
         die("excludes must be a list of string patterns")
 
+    middlewares = cfg.get("middlewares") or []
+    if not isinstance(middlewares, list) or any(not isinstance(m, str) for m in middlewares):
+        die("middlewares must be a list of Traefik file-provider middleware names")
+
     site = {
         "domain": cfg["domain"],
         "type": site_type,
@@ -95,6 +99,7 @@ def parse_site_yaml(site_dir):
         "content_dir": cfg.get("content_dir", ""),
         "tidy": cfg.get("tidy", True),
         "excludes": excludes,
+        "middlewares": middlewares,
     }
 
     print("Site config:")