feat(paperclip): migrate Ingress to Gateway API (#133)

## Summary

- Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass
- TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer`
- external-dns annotations moved to the Gateway

## Test plan

- [ ] ArgoCD syncs the paperclip app cleanly
- [ ] cert-manager issues the `paperclip-tls` certificate
- [ ] external-dns creates the DNS record
- [ ] `https://paperclip.k8s.syd1.au.unkin.net` is reachable

Reviewed-on: #133

apps/base/paperclip/kustomization.yaml

@@ -6,7 +6,8 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
   - deployment.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
   - namespace.yaml
   - services.yaml
   - vaultauth.yaml