cheeztv: terminate public cheeztv.unkin.net TLS with the LE *.unkin.net wildcard (#417)

why: cheeztv.unkin.net needs a publicly-trusted cert; DNS-01 via the delegated acme.unkin.net zone is now working (staging wildcard verified end-to-end in ~70s). A single centrally-managed wildcard avoids per-host CNAMEs and LE duplicate-order rate limits.

- add Certificate wildcard-unkin-net (cert-manager ns, ClusterIssuer letsencrypt prod, secret wildcard-unkin-net-tls) with emberstack reflector secretTemplate annotations
- reflect the secret into the cheeztv namespace (append future consumers to the two reflector namespace lists)
- point the public cheeztv gateway listener at wildcard-unkin-net-tls and drop its vault-issuer annotations (cheeztv-internal stays on vault-issuer)

Reviewed-on: #417
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/cert-manager/certificate_wildcard-unkin-net.yaml

@@ -0,0 +1,27 @@
+---
+# Single, centrally-managed Let's Encrypt *.unkin.net wildcard. DNS-01 validates
+# once against the delegated _acme-challenge.unkin.net CNAME, so consumers get a
+# real public leaf without per-host challenge records. The minted secret carries
+# emberstack reflector annotations (via secretTemplate) so it is auto-reflected
+# into consumer namespaces; append future consumers to the *-namespaces lists.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-unkin-net
+  namespace: cert-manager
+spec:
+  secretName: wildcard-unkin-net-tls
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv"
+  privateKey:
+    size: 4096
+  dnsNames:
+    - "*.unkin.net"
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+    group: cert-manager.io

apps/base/cert-manager/kustomization.yaml

@@ -11,3 +11,4 @@ resources:
   - vmservicescrape.yaml
   - clusterissuer_letsencrypt.yaml
   - clusterissuer_letsencrypt-staging.yaml
+  - certificate_wildcard-unkin-net.yaml

apps/base/cheeztv/gateway.yaml

@@ -1,17 +1,17 @@
 ---
 # Friendly public hostname for the kids instance, cheeztv.unkin.net. Same
 # internal-Traefik + external-dns pattern as logviewer.unkin.net: external-dns
-# publishes the A record at the internal LB VIP (198.18.200.4) and cert-manager
-# mints cheeztv-tls (CN cheeztv.unkin.net) off the Vault-PKI cluster issuer.
+# publishes the A record at the internal LB VIP (198.18.200.4). Public TLS is
+# terminated with the real Let's Encrypt *.unkin.net wildcard, centrally minted
+# once in the cert-manager namespace (Certificate wildcard-unkin-net) and
+# reflected into this namespace by the emberstack reflector as the secret
+# wildcard-unkin-net-tls, not the Vault PKI issuer.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
   labels:
     traefik.io/instance: internal
   annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: cheeztv.unkin.net
-    cert-manager.io/private-key-size: "4096"
     external-dns.alpha.kubernetes.io/hostname: cheeztv.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
   name: cheeztv
@@ -37,7 +37,7 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: cheeztv-tls
+            name: wildcard-unkin-net-tls
         mode: Terminate
 ---
 # Cluster hostname variant, mirroring fafflix's jellyfin.k8s.syd1.au.unkin.net