The five forwards are not optional and not independent: the portals' OIDC authority is pinned to localhost:30180, so forwarding the portal without Keycloak gets ERR_CONNECTION_REFUSED on the discovery document and an opaque "[object Object]" in the console. One ssh replaces `make k8s-portals` for the lab server, and needs no kubeconfig. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>