fix: flatten IngressRoute POST match to single-line string
YAML >- folded scalar preserved literal newlines in the match rule,
causing Traefik to reject it silently — POST filter requests fell
through to the admin catch-all and got 401 instead of passing through.
verified: filter POSTs return 200 unauthenticated, write POSTs return
401 unauthenticated and 422 with credentials.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>