traefik-internal: add ldaps :636 entrypoint for authentik LDAPS

Why:
- traefik-internal has no 636 entrypoint, so the authentik-ldap Gateway's
  636/TLS passthrough listeners are invalid and the whole Gateway is
  rejected (Accepted: False), taking LDAPS down.
- The traefik-internal LoadBalancer only publishes 80/443, so nothing
  reaches the Authentik LDAP outpost on 636.

How:
- Add an `ldaps` entrypoint on :636 (raw TCP, no TLS termination) to the
  traefik-internal helm values so 636/TLS passthrough streams pass through
  to the LDAP outpost.
- Expose 636 on the traefik-internal LoadBalancer via the port's
  `expose.default`, keeping the pinned 198.18.200.4 / common group.

apps/overlays/au-syd1/traefik-system/values-internal.yaml

@@ -100,5 +100,11 @@ ports:
     port: 443
   vault-direct:
     port: 8200
+  ldaps:
+    port: 636
+    exposedPort: 636
+    expose:
+      default: true
+    protocol: TCP
 
 enabled: true