helm: optional admin panel (warp-admin)

admin.enabled (off by default) adds a Deployment and Service for
warp-admin on :8009, pointed at the homeserver's Service, with /healthz
probes and an optional ingress on its own host. The pods carry their own
name label so the homeserver's Service never selects them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/deployment.md

@@ -80,6 +80,22 @@ prometheus-operator `ServiceMonitor`. The ingress needs a read timeout
 above the 30-second long poll; `values.yaml` has the ingress-nginx
 annotations.
 
+The admin panel is off by default. `admin.enabled=true` adds a Deployment
+and Service for `warp-admin` on port 8009, pointed at the homeserver's
+Service. Its image is built separately, also from the repository root:
+
+```sh
+docker build -t registry.example.org/warp-admin:0.10.0 -f apps/admin/Dockerfile .
+helm upgrade warp deploy/helm/warp --reuse-values   --set admin.enabled=true   --set admin.image.repository=registry.example.org/warp-admin   --set admin.image.tag=0.10.0
+```
+
+Without an ingress, reach it with `kubectl port-forward svc/warp-admin
+8009`. `admin.ingress.enabled` with `admin.ingress.host` gives it its own
+ingress on a separate host, ideally one only admins can reach. warp-admin
+reaches `/_warp/admin` inside the cluster, so you can then drop `/_warp`
+from `ingress.hosts[].paths`. `admin.resources` and `admin.replicas` are in
+`values.yaml`.
+
 ## Reverse proxy
 
 Behind a proxy that terminates TLS: