feat(fc-desktop): add /guacamole PathPrefix route to IngressRoute

Single-host Guacamole routing — Traefik matches Host=desktop.iamworkin.lan
+ PathPrefix=/guacamole first (priority 20) and forwards to the
guacamole Service in the guacamole namespace on 8080. The existing
Host-only catch-all rule drops to priority 10 so Guacamole traffic
resolves to the more-specific match.

Mirrors the IngressRoute in FlowerCore.RemoteDesktop@master (merged
as part of codex/single-host-guacamole-wip). The RemoteDesktop repo
copy is deploy-ref only — ArgoCD owns the live IngressRoute via
this manifest. Without this change, GuacamolePublicUrl=
https://desktop.iamworkin.lan/guacamole returns 404 because Traefik
routes the whole Host to remotedesktop-web.

Unblocks the per-template AAT smoke against the new public URL
path + closes the final live piece of Codex's single-host routing
work.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/fc-desktop/fc-desktop.yaml

@@ -23,8 +23,23 @@ spec:
   entryPoints:
     - websecure
   routes:
+    # Single-host Guacamole routing: Traefik forwards the /guacamole
+    # path-prefix directly to the guacamole Service in the guacamole
+    # namespace. Must precede the catch-all Host() rule so priority
+    # resolves the more-specific match first. RemoteDesktop.Web then
+    # emits launch URLs with host=desktop.iamworkin.lan + /guacamole
+    # prefix, keeping Guacamole reachable through the same public
+    # surface (GuacamolePublicUrl=https://desktop.iamworkin.lan/guacamole).
+    - match: Host(`desktop.iamworkin.lan`) && PathPrefix(`/guacamole`)
+      kind: Rule
+      priority: 20
+      services:
+        - name: guacamole
+          namespace: guacamole
+          port: 8080
     - match: Host(`desktop.iamworkin.lan`)
       kind: Rule
+      priority: 10
       services:
         - name: remotedesktop-web
           port: 8080