fix(api): expose internal namespace lookup for SSH service

[gustavosbarreto]

Summary

Add GET /internal/namespaces/:tenant bound to the same handler as the public route but without the tenant guard, and point internalclient.NamespaceLookup at it.

The SSH service calls NamespaceLookup directly on api:8080 without passing through the nginx /auth subrequest, so the RequiresTenant guard added on /api/namespaces/:tenant in fe8e2bd was turning every SSH connection into a 403.

Backported to release/v0.21.6 as 9881a99.

[github-actions]

Claude finished @gustavosbarreto's task in 2m 17s —— View job

---

Code Review Complete

Reviewed 2 files across code quality, security, testing, language patterns, and architecture — no issues found. The code looks good as-is.

Key observations:

• The new /internal/namespaces/:tenant route correctly reuses the existing GetNamespaceURL constant and handler.GetNamespace handler under the /internal group, which is network-isolated (no external exposure via nginx gateway).
• The client URL change in internalclient correctly points to the new internal route.
• The handler's membership guard (if uid != "") naturally short-circuits for unauthenticated internal callers, returning the namespace without a 403.
• Cross-repo impact is clean — cloud/ only has an auto-generated mock for NamespaceLookup, and the SSH service (ssh/session/session.go) picks up the fix transparently.

---

To request another review round, comment /review.