feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager

All prod IngressRoutes switch tls.certResolver to tls.secretName
backed by per-router Certificates (HTTP-01, letsencrypt-prod).
adguard-prod reuses the shared adguard-certs secret (also feeds
DoT :853); sync CronJob removed as redundant.

Traefik certificatesResolvers removed: its internal
acme-http@internal router hijacks HTTP-01 for every host while
enabled, blocking external solvers. Dormant files (kener,
downtify) converted for consistency but not applied; n8n
untouched per live-only rule.

uptime-kuma/k8s/ingress.yaml

@@ -16,7 +16,7 @@ spec:
         - name: uptime-kuma-service
           port: 3001
   tls:
-    certResolver: letsencrypt
+    secretName: uptime-kuma-prod-tls
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute