ui and tiltfile tweaks, update docs

ctrl/Tiltfile

@@ -63,21 +63,22 @@ k8s_resource('postgres')
 k8s_resource('api', resource_deps=['postgres'])
 k8s_resource('ui', resource_deps=['api'])
 k8s_resource('docs')
+# In-cluster Caddy reverse proxy: owns the single NodePort (30060) and routes by
+# Host header to ui / api / docs. The host's dnsmasq + system Caddy forward
+# *.local.ar to this NodePort — gateway is this cluster's ingress, not the
+# multi-cluster host routing.
+# NOTE: editing k8s/base/Caddyfile won't roll the pod on its own
+# (disableNameSuffixHash keeps the configMap name stable). Apply Caddyfile edits
+# with: kubectl --context kind-nvi -n nvi rollout restart deployment/gateway
 k8s_resource('gateway', resource_deps=['ui', 'api', 'docs'])
 
-# Hot-reload gateway Caddy on Caddyfile edit. configMapGenerator uses
-# disableNameSuffixHash so the Deployment template doesn't change → kustomize
-# won't roll the pod on its own. This local_resource closes the loop.
-local_resource(
-    'gateway-reload',
-    cmd='kubectl --context kind-nvi -n nvi rollout restart deployment/gateway',
-    deps=['k8s/base/Caddyfile'],
-    resource_deps=['gateway'],
-    auto_init=False,
-)
-
-# Group infra objects
+# Group infra objects (namespace, configmaps, the .env-backed secret).
 k8s_resource(
-    objects=['nvi:namespace', 'nvi-config:configmap', 'gateway-config:configmap'],
+    objects=[
+        'nvi:namespace',
+        'nvi-config:configmap',
+        'gateway-config:configmap',
+        'nvi-secrets:secret',
+    ],
     new_name='infra',
 )