feat(tls): internal CA wildcard for *.internal routes

Selfsigned root (10y) + internal-ca issuer; per-namespace
internal-wildcard-tls certs referenced by all -local routers.
Root public cert committed for client trust stores.

prometheus-stack/k8s/ingress.yaml

@@ -32,3 +32,5 @@ spec:
       services:
         - name: prometheus-stack-grafana
           port: 80
+  tls:
+    secretName: internal-wildcard-tls