cheeztv: manage the LE *.unkin.net wildcard centrally, reflect into cheeztv

Per review, the *.unkin.net Let's Encrypt wildcard is no longer minted
per-namespace. A single Certificate (wildcard-unkin-net) now lives in the
cert-manager namespace and carries emberstack reflector source annotations via
spec.secretTemplate.annotations, so its secret (wildcard-unkin-net-tls) is
auto-reflected into consumer namespaces. Future consumers are added by
appending to the comma-separated reflection-*-namespaces lists.

Drop apps/base/cheeztv/certificate.yaml and its kustomization entry, and point
the public cheeztv gateway https listener at the reflected wildcard-unkin-net-tls
secret. cheeztv-internal keeps its Vault PKI leaf.

apps/base/cert-manager/kustomization.yaml

@@ -11,3 +11,4 @@ resources:
   - vmservicescrape.yaml
   - clusterissuer_letsencrypt.yaml
   - clusterissuer_letsencrypt-staging.yaml
+  - certificate_wildcard-unkin-net.yaml