feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager

All prod IngressRoutes switch tls.certResolver to tls.secretName
backed by per-router Certificates (HTTP-01, letsencrypt-prod).
adguard-prod reuses the shared adguard-certs secret (also feeds
DoT :853); sync CronJob removed as redundant.

Traefik certificatesResolvers removed: its internal
acme-http@internal router hijacks HTTP-01 for every host while
enabled, blocking external solvers. Dormant files (kener,
downtify) converted for consistency but not applied; n8n
untouched per live-only rule.

traefik/k8s/certificates.yaml

@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dashboard-prod-tls
+  namespace: traefik
+spec:
+  secretName: dashboard-prod-tls
+  dnsNames:
+    - traefik.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer

traefik/k8s/ingress.yaml

@@ -17,7 +17,7 @@ spec:
         - name: api@internal
           kind: TraefikService
   tls:
-    certResolver: letsencrypt
+    secretName: dashboard-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute

traefik/k8s/traefik-values.yaml

@@ -121,14 +121,11 @@ persistence:
   size: 100Mi
   path: /data
 
-certificatesResolvers:
-  letsencrypt:
-    acme:
-      email: bobrovod@national.shitposting.agency
-      storage: /data/letsencrypt/acme.json
-      caServer: https://acme-v02.api.letsencrypt.org/directory
-      httpChallenge:
-        entryPoint: web
+# NOTE: no certificatesResolvers — public TLS is issued by cert-manager
+# (see cert-manager/k8s/clusterissuer.yaml and per-service certificates.yaml).
+# Traefik must not run its own ACME httpChallenge: its internal
+# acme-http@internal router hijacks /.well-known/acme-challenge/ for every
+# host and breaks external HTTP-01 solvers.
 
 volumes:
   - name: traefik-dynamic