feat(irc): add Istio ambient mode, waypoint, and AuthorizationPolicies

- Add namespace.yaml with istio ambient + waypoint labels
- Add waypoint Gateway (istio-waypoint) scoped to irc namespace
- Switch thelounge HTTPRoute from Cilium external to istio-external gateway
- Add AuthorizationPolicy for thelounge (allow inbound from gateway-system only)
- Add AuthorizationPolicy for znc (allow all on port 6501 for IRC clients)
- Add namespace: irc to root kustomization, remove dependency on targetNamespace

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

znc/authorizationpolicy.yaml

@@ -0,0 +1,16 @@
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: znc
+  namespace: irc
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: znc
+  action: ALLOW
+  rules:
+  - to:
+    - operation:
+        ports:
+        - "6501"

znc/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - statefulset.yaml
   - service.yaml
+  - authorizationpolicy.yaml