fix(oidc): Switch LibreChat and MCP OAuth to local Keycloak (keycloak.sttlab.local)

k8s/ingress/ingress.yaml

@@ -9,17 +9,22 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-buffering: "off"
     nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
-    nginx.ingress.kubernetes.io/configuration-snippet: |
-      proxy_set_header Upgrade $http_upgrade;
-      proxy_set_header Connection "upgrade";
+    # configuration-snippet (WebSocket Upgrade/Connection headers) removed —
+    # this cluster's ingress-nginx has snippet annotations disabled
+    # (admission webhook rejects them outright). If any LibreChat feature
+    # turns out to need raw WebSocket upgrade specifically (vs. the SSE/
+    # HTTP-1.1 streaming already covered by proxy-buffering/proxy-http-version
+    # above), this needs a different mechanism — e.g. a ConfigMap-based
+    # global nginx snippet if the cluster admin allows one, since per-Ingress
+    # snippets are blocked here.
 spec:
   ingressClassName: nginx
   tls:
     - hosts:
-        - librechat.sttlab.pc
+        - librechat.sttlab.local
       secretName: sttlab-tls
   rules:
-    - host: librechat.sttlab.pc
+    - host: librechat.sttlab.local
       http:
         paths:
           - path: /