fix(adguard): drop retired adguard.forust.xyz from prod route so dns.forust.xyz gets LE cert

adguard.forust.xyz is NXDOMAIN (host retired); the combo SAN cert kept
failing and dns.forust.xyz served TRAEFIK DEFAULT CERT. Scope prod route
to dns.forust.xyz only.

Also commit live traefik-values state (remove letsencrypt-staging
resolver, live since helm rev 33).

adguardhome/k8s/ingress.yaml

@@ -7,7 +7,7 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)
+    - match: Host(`dns.forust.xyz`)
       kind: Rule
       middlewares:
         - name: crowdsec-bouncer
@@ -15,7 +15,7 @@ spec:
       services:
         - name: adguard-service
           port: 3000
-    - match: (Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
+    - match: (Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
       kind: Rule
       services:
         - name: adguard-service