Switch Let's Encrypt ClusterIssuers to RFC2136/TSIG solver

The clouddns approach is dropped in favour of self-delegating the ACME
challenge to our own BIND: a one-time CNAME sends _acme-challenge.unkin.net
into acme.unkin.net (served by bind-external), and cert-manager solves DNS-01
via RFC2136+TSIG against it. No GCP service account or Vault KV secret needed.

- Replace the dns01 clouddns solver in both ClusterIssuers with rfc2136
  (nameserver 198.18.199.53:53, key certmanager, HMACSHA256, secret
  certmanager-tsig reflected into the cert-manager namespace).
- Remove the now-unneeded VaultAuth, VaultStaticSecret and clouddns
  ServiceAccount.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/base/cert-manager/kustomization.yaml

@@ -5,11 +5,8 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - serviceaccount.yaml
-  - serviceaccount_cert-manager-clouddns.yaml
   - clusterrole.yaml
   - clusterrolebinding.yaml
   - vmservicescrape.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret_clouddns.yaml
   - clusterissuer_letsencrypt.yaml
   - clusterissuer_letsencrypt-staging.yaml