Trust internal CA in cephrgw-operator (fix radosgw TLS) (#276)

## Why

cephrgw-operator v0.2.0 talks to radosgw over HTTPS (`radosgw.service.consul:443`, fronted by nginx presenting the internal `unkin.net` Vault-PKI cert). With no CA configured the operator fails:

```
Get "https://radosgw.service.consul:443/admin/user?...": tls: failed to verify certificate: x509: certificate signed by unknown authority
```

The `vault-ca-cert` Secret (the `unkin.net` intermediate+root) is already reflected into every namespace — including `cephrgw-system` — so the fix is deployment-only.

## Changes

- mount the `vault-ca-cert` Secret (key `ca.crt`) read-only at `/etc/vault-ca/ca.crt`, following the puppet/artifactapi pattern
- set `CEPH_RGW_CA_FILE=/etc/vault-ca/ca.crt` so the operator adds the CA to its TLS trust

No image change (still `v0.2.0`); `reloader` + a normal reconcile pick it up. Validated with `kustomize build` on the au-syd1 overlay.

https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
Reviewed-on: #276
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/cephrgw-system/deployment.yaml

@@ -36,6 +36,17 @@ spec:
             # Vault per docs/ceph-setup.md; not managed in GitOps.
             - secretRef:
                 name: cephrgw-credentials
+          env:
+            # Trust the internal unkin.net (Vault PKI) CA so the operator can
+            # verify radosgw's TLS cert. vault-ca-cert is reflected into every
+            # namespace from the certificates namespace.
+            - name: CEPH_RGW_CA_FILE
+              value: /etc/vault-ca/ca.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /etc/vault-ca/ca.crt
+              subPath: ca.crt
+              readOnly: true
           ports:
             - containerPort: 8080
               name: metrics
@@ -65,3 +76,7 @@ spec:
             limits:
               cpu: 500m
               memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert