fix: kubeconfig server accessible via port forwarding, integration tests use proper auth

Bind kubeconfig HTTP server to 0.0.0.0:8080 (was 127.0.0.1) so integration
tests can reach it via QEMU SLIRP port forwarding. Add shared wait_for_boot
and fetch_kubeconfig helpers to qemu-helpers.sh. Update all 5 integration
tests to fetch kubeconfig via HTTP and use it for kubectl authentication.

All 6 tests pass on Linux with KVM: boot (18s), security (7/7), K8s ready
(15s), workload deploy, local storage, network policy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test/lib/qemu-helpers.sh

@@ -80,3 +80,60 @@ detect_kvm() {
         echo "-enable-kvm"
     fi
 }
+
+# wait_for_boot <serial-log> <qemu-pid> [timeout]
+# Waits for "KubeSolo is running" marker in serial log.
+# Returns 0 on success, 1 on timeout/failure.
+# Sets BOOT_ELAPSED to seconds taken.
+wait_for_boot() {
+    local serial_log="$1"
+    local qemu_pid="$2"
+    local timeout="${3:-180}"
+
+    BOOT_ELAPSED=0
+    while [ "$BOOT_ELAPSED" -lt "$timeout" ]; do
+        if grep -q "\[kubesolo-init\] \[OK\] KubeSolo is running" "$serial_log" 2>/dev/null; then
+            echo ""
+            echo "    Boot completed in ${BOOT_ELAPSED}s"
+            return 0
+        fi
+        if ! kill -0 "$qemu_pid" 2>/dev/null; then
+            echo ""
+            echo "==> FAIL: QEMU exited prematurely"
+            tail -20 "$serial_log" 2>/dev/null
+            return 1
+        fi
+        sleep 2
+        BOOT_ELAPSED=$((BOOT_ELAPSED + 2))
+        printf "\r    Elapsed: %ds / %ds" "$BOOT_ELAPSED" "$timeout"
+    done
+    echo ""
+    echo "==> FAIL: Boot did not complete within ${timeout}s"
+    tail -30 "$serial_log" 2>/dev/null
+    return 1
+}
+
+# fetch_kubeconfig <host-port> <output-file>
+# Fetches kubeconfig via HTTP from the given host port.
+# The port should be the QEMU-forwarded host port mapped to guest port 8080.
+# Returns 0 on success, 1 on failure.
+fetch_kubeconfig() {
+    local port="$1"
+    local output_file="$2"
+
+    echo "    Fetching kubeconfig from http://localhost:${port}..."
+    local j=0
+    while [ $j -lt 30 ]; do
+        if curl -sf "http://localhost:${port}" -o "$output_file" 2>/dev/null; then
+            if [ -s "$output_file" ] && grep -q "server:" "$output_file" 2>/dev/null; then
+                echo "    Kubeconfig fetched successfully"
+                return 0
+            fi
+        fi
+        sleep 2
+        j=$((j + 1))
+    done
+
+    echo "==> FAIL: Could not fetch kubeconfig from http://localhost:${port}"
+    return 1
+}