fix(deploy): use FQDN for SpiceDB endpoint in stage

[jsell-rh]

Summary

OpenShift service serving certs have SANs for the full service DNS name (kartograph-spicedb.kartograph-stage.svc), not the short name (kartograph-spicedb). The TLS client verifies the hostname against the cert and fails with: "Peer name kartograph-spicedb is not in peer certificate".

Adds SPICEDB_ENDPOINT override in the stage overlay to use the FQDN.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated configuration for the stage deployment environment.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 637a04d3-8d3d-450e-9b8d-bf31f37fa99e

📥 Commits

Reviewing files that changed from the base of the PR and between 3fc519c and dd48fd2.

📒 Files selected for processing (1)

• deploy/apps/kartograph/overlays/stage/configmap-patch.yaml

---

Walkthrough

The change adds a new configuration entry SPICEDB_ENDPOINT with the value kartograph-spicedb.kartograph-stage.svc:50051 to the stage environment's kartograph-config ConfigMap. This explicitly defines the Spicedb endpoint for the stage overlay, with a comment noting TLS SAN matching considerations.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: using an FQDN (fully qualified domain name) for the SpiceDB endpoint configuration in the stage environment, which directly addresses the TLS certificate validation issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jsell/fix/spicedb-fqdn

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}