docs: tick off the routes and note what the switch-over needs

docs/upgrade-k8s-1.33.md

@@ -94,15 +94,24 @@ snapshots after every step. Fresh Velero backup before starting.
   OIDC
   - [x] Envoy Gateway v1.9.2 next to nginx. Gateway `homelab` in
     `envoy-gateway-system`, Envoy on host ports 10080/10443 (`gateway/`)
-  - [ ] One app (gatus, s2.rubenhensen.nl) on an HTTPRoute, reusing its
+  - [x] One app (gatus, s2.rubenhensen.nl) on an HTTPRoute, reusing its
     existing certificate through a ReferenceGrant; test with
     `curl --resolve <host>:10443:192.168.1.204`
-  - [ ] Longhorn behind authentik OIDC with a SecurityPolicy
-  - [ ] The other apps. Envoy cuts requests off after 15s by default, so
-    uploads and streams need `timeouts.request: 0s`
-  - [ ] Switch over: `microk8s disable ingress`, Envoy on 80/443, cert-manager
-    `enableGatewayAPI` and an HTTP-01 solver on the Gateway
-  - [ ] Remove the Ingress objects and nginx annotations
+  - [ ] Longhorn behind authentik OIDC with a SecurityPolicy. Ready on the
+    local branch `longhorn-oidc`; needs `client_secret` in Vault at
+    `kv/longhorn-oidc` first, or authentik's pods won't start
+  - [x] The other apps. Envoy cuts requests off after 15s by default, so the
+    routes set `timeouts.request: 0s`. All hosts answer the same through
+    Envoy as through nginx; WordPress only redirects on the test port
+    because the Host header carries `:10443`
+  - [x] Argo CD on `server.insecure`, so both nginx and Envoy talk plain
+    HTTP to argocd-server
+  - [x] cert-manager `config.gatewayAPI.enabled`
+  - [ ] Switch over: `microk8s disable ingress`, Envoy on 80/443, and a
+    `gatewayHTTPRoute` HTTP-01 solver on the ClusterIssuer
+  - [ ] Replace the Ingress objects with Certificate resources (the
+    ingress-shim Certificates go with their Ingress, and gateway-shim
+    can't write to the app namespaces) and drop the nginx annotations
 
 Out of scope here but due: the immich PostgreSQL 14 cluster reaches end of
 life on 2026-11-12.