infra gateway: HTTPS is live. Next: SSO gate + reverse proxies.