Trust internal CA in cephrgw-operator (fix radosgw TLS)

cephrgw-operator v0.2.0 talks to radosgw over HTTPS
(radosgw.service.consul:443, fronted by nginx with the internal unkin.net
Vault-PKI cert). With no CA configured it fails with x509 "certificate signed
by unknown authority". Mount the reflected vault-ca-cert and point the operator
at it.

- mount the vault-ca-cert Secret (key ca.crt) read-only at
  /etc/vault-ca/ca.crt, following the puppet/artifactapi pattern
- set CEPH_RGW_CA_FILE to that path so the operator adds the CA to its trust

Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

apps/base/cephrgw-system/deployment.yaml

@@ -36,6 +36,17 @@ spec:
             # Vault per docs/ceph-setup.md; not managed in GitOps.
             - secretRef:
                 name: cephrgw-credentials
+          env:
+            # Trust the internal unkin.net (Vault PKI) CA so the operator can
+            # verify radosgw's TLS cert. vault-ca-cert is reflected into every
+            # namespace from the certificates namespace.
+            - name: CEPH_RGW_CA_FILE
+              value: /etc/vault-ca/ca.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /etc/vault-ca/ca.crt
+              subPath: ca.crt
+              readOnly: true
           ports:
             - containerPort: 8080
               name: metrics
@@ -65,3 +76,7 @@ spec:
             limits:
               cpu: 500m
               memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert