feat(puppet): migrate puppetdb Ingress to Gateway API (#131)

## Summary

- Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass
- TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer`
- external-dns annotations moved to the Gateway
- `ingress_puppetboard.yaml` is unchanged in this PR (separate PR)

## Test plan

- [ ] ArgoCD syncs the puppet app cleanly
- [ ] cert-manager issues the `puppetdb-tls` certificate
- [ ] external-dns creates the DNS record
- [ ] `https://puppetdb.k8s.syd1.au.unkin.net` is reachable

Reviewed-on: #131

apps/base/puppet/kustomization.yaml

@@ -27,7 +27,8 @@ resources:
   - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
   - gateway_puppetboard.yaml
   - httproute_puppetboard.yaml
-  - ingress_puppetdb.yaml
+  - gateway_puppetdb.yaml
+  - httproute_puppetdb.yaml
   - service_puppetserver-agents-to-puppet.yaml
   - service_puppet-headless.yaml
   - service_puppet.yaml