fix(irc): remove namespace from istio ambient mode

Drop the istio.io/dataplane-mode label and the AuthorizationPolicies
for thelounge and znc. Gateway was returning upstream connect errors
when traffic transited ztunnel; reverting the namespace to non-mesh
restores reachability. CiliumNetworkPolicies remain for egress filtering.

namespace.yaml

@@ -2,5 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: irc
-  labels:
-    istio.io/dataplane-mode: ambient

thelounge/authorizationpolicy.yaml

@@ -1,15 +0,0 @@
-apiVersion: security.istio.io/v1
-kind: AuthorizationPolicy
-metadata:
-  name: thelounge
-  namespace: irc
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: thelounge
-  action: ALLOW
-  rules:
-  - from:
-    - source:
-        namespaces:
-        - gateway-system

thelounge/kustomization.yaml

@@ -4,6 +4,5 @@ resources:
   - statefulset.yaml
   - service.yaml
   - httproute.yaml
-  - authorizationpolicy.yaml
   - ciliumnetworkpolicy.yaml
   - config.yaml

znc/authorizationpolicy.yaml

@@ -1,19 +0,0 @@
-apiVersion: security.istio.io/v1
-kind: AuthorizationPolicy
-metadata:
-  name: znc
-  namespace: irc
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: znc
-  action: ALLOW
-  rules:
-  - from:
-    - source:
-        namespaces:
-        - irc
-  - to:
-    - operation:
-        ports:
-        - "6501"

znc/kustomization.yaml

@@ -3,5 +3,4 @@ kind: Kustomization
 resources:
   - statefulset.yaml
   - service.yaml
-  - authorizationpolicy.yaml
   - ciliumnetworkpolicy.yaml