feat(authup): track authup 1.0.0-beta.66

[tada5hi]

Adopts Authup v1.0.0-beta.66.

What changed upstream

Verified by diffing the authup monorepo at v1.0.0-beta.65..v1.0.0-beta.66:

• Dockerfile and entrypoint.sh are unchanged, so the image entrypoint contract holds.
• packages/server-config/src gained no field: no new environment variables and no new server.config long-tail options.
• apps/authup/src/module.ts only adds operator-side commands (login, logout, whoami, api <entity>, a CLI that signs itself in through the device grant) beside an unchanged start tree. Role args and ports are identical.

Three deployment-facing facts, none of which needs a chart value:

1. Device authorization grant (RFC 8628). /device_authorization and the hosted /device page sit outside /console, so they ride the server catch-all, and the /device redirect target /console/auth/device rides the auth console's existing /console/auth prefix. Confirmed against rendered split manifests, not just the upstream note. The grant is opt-in per client through the provisioning field grantTypes.
2. The auth console render contract is version 5 (was 3). A bundle substituted through AUTH_CONSOLE_PATH and built against an older contract is refused at boot and must be rebuilt. Called out in artifacthub.io/changes.
3. Console permission gating, token client narrowing, realm-gated entity reads and the new permission_check permission are API and provisioning behavior. They change which grants an operator hands out, not what the chart renders.

Changes

File	Change
charts/authup/Chart.yaml	appVersion to 1.0.0-beta.66; rewrote artifacthub.io/changes
.agents/references/authup.md	Re-pinned to beta.66 with the delta, plus a durable fact that paths outside /console belong to the API set through the catch-all
.agents/architecture.md	Invariant 15 now states the server catch-all is load-bearing for hosted pages
scripts/check-beta64-contract.py	New assertions for that catch-all
charts/authup/README.md.gotmpl	Topology sentence now renders from appVersion
charts/authup/README.md	Regenerated

Drive-by fix

The README prose read "It runs Authup v1.0.0-beta.64's role-based CLI topology" with the version hardcoded, so it was already stale at beta.65. It now renders {{ template "chart.appVersion" . }}.

Contract assertions

check_routing now asserts, in split mode, that:

• the server Ingress catch-all is last, path: /, pathType: Prefix, backed by the API Service
• the server HTTPRoute's last rule carries no matches (an empty match is the catch-all) and points at the API Service

Both were mutation-tested: breaking the catch-all path in each branch of _ingress.tpl fires the matching assertion, and _ingress.tpl is unmodified in this PR.

Verification

• make test passes (lint, the seven ci/*-values.yaml renders, 476-path values coverage, the full contract script)
• make docs schema produces no drift beyond the regenerated README committed here

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.