feat(tls): internal CA wildcard for *.internal routes

Selfsigned root (10y) + internal-ca issuer; per-namespace
internal-wildcard-tls certs referenced by all -local routers.
Root public cert committed for client trust stores.

traefik/k8s/certificates.yaml

@@ -10,3 +10,19 @@ spec:
   issuerRef:
     name: letsencrypt-prod
     kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: internal-wildcard-tls
+  namespace: traefik
+spec:
+  secretName: internal-wildcard-tls
+  dnsNames:
+    - "*.workstation.internal"
+    - "*.gigaforust.internal"
+    - workstation.internal
+    - gigaforust.internal
+  issuerRef:
+    name: internal-ca
+    kind: ClusterIssuer

traefik/k8s/ingress.yaml

@@ -33,3 +33,5 @@ spec:
       services:
         - name: api@internal
           kind: TraefikService
+  tls:
+    secretName: internal-wildcard-tls

traefik/k8s/traefik-values.yaml

@@ -121,11 +121,7 @@ persistence:
   size: 100Mi
   path: /data
 
-# NOTE: no certificatesResolvers — public TLS is issued by cert-manager
-# (see cert-manager/k8s/clusterissuer.yaml and per-service certificates.yaml).
-# Traefik must not run its own ACME httpChallenge: its internal
-# acme-http@internal router hijacks /.well-known/acme-challenge/ for every
-# host and breaks external HTTP-01 solvers.
+# No certificatesResolvers: public TLS comes from cert-manager.
 
 volumes:
   - name: traefik-dynamic