auth-proxy: reusable ingress with auth proxy object for cue configs (#113)

affects: #110

Creates reusable auth proxy object in base cue config, and migrates rpuppy, url-shortener, pihole and memberships app to it.

Memberships app always requires authentication.
url-shortener now supports non-auth based interactions.
diff --git a/core/installer/app_manager.go b/core/installer/app_manager.go
index 05cb496..744f9a2 100644
--- a/core/installer/app_manager.go
+++ b/core/installer/app_manager.go
@@ -132,6 +132,7 @@
 	return m.repoIO.RemoveApp(filepath.Join(appDir, instanceId))
 }
 
+// TODO(gio): deduplicate with cue definition in app.go, this one should be removed.
 func CreateNetworks(global Config) []Network {
 	return []Network{
 		{