cheeztv: manage the LE *.unkin.net wildcard centrally, reflect into cheeztv

Per review, the *.unkin.net Let's Encrypt wildcard is no longer minted
per-namespace. A single Certificate (wildcard-unkin-net) now lives in the
cert-manager namespace and carries emberstack reflector source annotations via
spec.secretTemplate.annotations, so its secret (wildcard-unkin-net-tls) is
auto-reflected into consumer namespaces. Future consumers are added by
appending to the comma-separated reflection-*-namespaces lists.

Drop apps/base/cheeztv/certificate.yaml and its kustomization entry, and point
the public cheeztv gateway https listener at the reflected wildcard-unkin-net-tls
secret. cheeztv-internal keeps its Vault PKI leaf.

apps/base/cert-manager/certificate_wildcard-unkin-net.yaml

@@ -0,0 +1,27 @@
+---
+# Single, centrally-managed Let's Encrypt *.unkin.net wildcard. DNS-01 validates
+# once against the delegated _acme-challenge.unkin.net CNAME, so consumers get a
+# real public leaf without per-host challenge records. The minted secret carries
+# emberstack reflector annotations (via secretTemplate) so it is auto-reflected
+# into consumer namespaces; append future consumers to the *-namespaces lists.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-unkin-net
+  namespace: cert-manager
+spec:
+  secretName: wildcard-unkin-net-tls
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv"
+  privateKey:
+    size: 4096
+  dnsNames:
+    - "*.unkin.net"
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+    group: cert-manager.io

apps/base/cert-manager/kustomization.yaml

@@ -11,3 +11,4 @@ resources:
   - vmservicescrape.yaml
   - clusterissuer_letsencrypt.yaml
   - clusterissuer_letsencrypt-staging.yaml
+  - certificate_wildcard-unkin-net.yaml

apps/base/cheeztv/certificate.yaml

@@ -1,21 +0,0 @@
----
-# Public-facing cheeztv.unkin.net terminates TLS with a real Let's Encrypt cert
-# instead of the internal Vault PKI leaf. A single *.unkin.net wildcard is used
-# so DNS-01 validates against the one delegated _acme-challenge.unkin.net CNAME
-# and no per-host _acme-challenge records are required. The cheeztv gateway's
-# https listener consumes this secret; cheeztv-internal keeps its Vault leaf.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: cheeztv-wildcard-tls
-  namespace: cheeztv
-spec:
-  secretName: cheeztv-wildcard-tls
-  privateKey:
-    size: 4096
-  dnsNames:
-    - "*.unkin.net"
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-    group: cert-manager.io

apps/base/cheeztv/gateway.yaml

@@ -2,8 +2,10 @@
 # Friendly public hostname for the kids instance, cheeztv.unkin.net. Same
 # internal-Traefik + external-dns pattern as logviewer.unkin.net: external-dns
 # publishes the A record at the internal LB VIP (198.18.200.4). Public TLS is
-# terminated with the real Let's Encrypt *.unkin.net wildcard from
+# terminated with the real Let's Encrypt *.unkin.net wildcard, centrally minted
-# certificate.yaml (secret cheeztv-wildcard-tls), not the Vault PKI issuer.
+# once in the cert-manager namespace (Certificate wildcard-unkin-net) and
+# reflected into this namespace by the emberstack reflector as the secret
+# wildcard-unkin-net-tls, not the Vault PKI issuer.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -35,7 +37,7 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: cheeztv-wildcard-tls
+            name: wildcard-unkin-net-tls
         mode: Terminate
 ---
 # Cluster hostname variant, mirroring fafflix's jellyfin.k8s.syd1.au.unkin.net

apps/base/cheeztv/kustomization.yaml

@@ -22,6 +22,5 @@ resources:
   - service.yaml
   - valkey.yaml
   - vmpodscrape.yaml
-  - certificate.yaml
   - gateway.yaml
   - httproute.yaml