fix: kubeconfig server accessible via port forwarding, integration tests use proper auth

Bind kubeconfig HTTP server to 0.0.0.0:8080 (was 127.0.0.1) so integration
tests can reach it via QEMU SLIRP port forwarding. Add shared wait_for_boot
and fetch_kubeconfig helpers to qemu-helpers.sh. Update all 5 integration
tests to fetch kubeconfig via HTTP and use it for kubectl authentication.

All 6 tests pass on Linux with KVM: boot (18s), security (7/7), K8s ready
(15s), workload deploy, local storage, network policy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test/integration/test-network-policy.sh

@@ -9,25 +9,30 @@ ISO="${1:?Usage: $0 <path-to-iso>}"
 TIMEOUT_K8S=${TIMEOUT_K8S:-300}
 TIMEOUT_POD=${TIMEOUT_POD:-120}
 API_PORT=6443
+KC_PORT=8080
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 . "$SCRIPT_DIR/../lib/qemu-helpers.sh"
 
 DATA_DISK=$(mktemp /tmp/kubesolo-data-XXXXXX.img)
-dd if=/dev/zero of="$DATA_DISK" bs=1M count=1024 2>/dev/null
+dd if=/dev/zero of="$DATA_DISK" bs=1M count=2048 2>/dev/null
 mkfs.ext4 -q -L KSOLODATA "$DATA_DISK" 2>/dev/null
 
 SERIAL_LOG=$(mktemp /tmp/kubesolo-netpol-XXXXXX.log)
 
 QEMU_PID=""
 EXTRACT_DIR=""
-KUBECTL="kubectl --server=https://localhost:${API_PORT} --insecure-skip-tls-verify"
+KUBECONFIG_FILE=""
 
 cleanup() {
-    $KUBECTL delete namespace netpol-test 2>/dev/null || true
+    [ -n "$KUBECONFIG_FILE" ] && [ -f "$KUBECONFIG_FILE" ] && {
+        kubectl --kubeconfig="$KUBECONFIG_FILE" --insecure-skip-tls-verify \
+            delete namespace netpol-test 2>/dev/null || true
+    }
     [ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null || true
     rm -f "$DATA_DISK" "$SERIAL_LOG"
+    [ -n "$KUBECONFIG_FILE" ] && rm -f "$KUBECONFIG_FILE"
     [ -n "$EXTRACT_DIR" ] && rm -rf "$EXTRACT_DIR"
 }
 trap cleanup EXIT
@@ -50,14 +55,23 @@ qemu-system-x86_64 \
     -initrd "$INITRAMFS" \
     -drive "file=$DATA_DISK,format=raw,if=virtio" \
     -net "nic,model=virtio" \
-    -net "user,hostfwd=tcp::${API_PORT}-:6443" \
+    -net "user,hostfwd=tcp::${API_PORT}-:6443,hostfwd=tcp::${KC_PORT}-:8080" \
     -serial "file:$SERIAL_LOG" \
-    -append "console=ttyS0,115200n8 kubesolo.data=/dev/vda" \
+    -append "console=ttyS0,115200n8 kubesolo.data=/dev/vda kubesolo.debug" \
     &
 QEMU_PID=$!
 
+# Wait for boot + fetch kubeconfig
+echo "    Waiting for boot..."
+wait_for_boot "$SERIAL_LOG" "$QEMU_PID" 180 || exit 1
+
+KUBECONFIG_FILE=$(mktemp /tmp/kubesolo-kubeconfig-XXXXXX.yaml)
+fetch_kubeconfig "$KC_PORT" "$KUBECONFIG_FILE" || exit 1
+
+KUBECTL="kubectl --kubeconfig=$KUBECONFIG_FILE --insecure-skip-tls-verify"
+
 # Wait for K8s
-echo "    Waiting for K8s API..."
+echo "    Waiting for K8s node Ready..."
 ELAPSED=0
 while [ "$ELAPSED" -lt "$TIMEOUT_K8S" ]; do
     if $KUBECTL get nodes 2>/dev/null | grep -q "Ready"; then