feat(tls): internal CA wildcard for *.internal routes

Selfsigned root (10y) + internal-ca issuer; per-namespace
internal-wildcard-tls certs referenced by all -local routers.
Root public cert committed for client trust stores.

headscale/k8s/routing/ingress.yaml

@@ -90,6 +90,9 @@ spec:
       services:
         - name: headscale-server-external
           port: 9090
+  tls:
+    secretName: internal-wildcard-tls
+
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -110,3 +113,5 @@ spec:
       services:
         - name: headplane-external
           port: 3000
+  tls:
+    secretName: internal-wildcard-tls