Provider sign-in proof cannot walk the Dex hop from inside the cluster #585

Problem

The lab Dex issuer is https://localhost:<port>/dex, so a pod cannot complete the Dex hop of a provider sign-in (the request is refused at Dex). The proof helper therefore walks the sign-in from the host only.

Proposed solution

Give the lab Dex an issuer reachable both from the host and from pods (a stable in-cluster name resolvable on the host), so the sign-in can be walked from a pod.

Acceptance criteria

• A provider sign-in proof completes with the walk running in a pod.
• The host walk keeps working.