Extend the LE *.unkin.net wildcard to arrstack + authentik (reflect into gitea)

why: after #417 stood up the central Let's Encrypt *.unkin.net wildcard
(Certificate wildcard-unkin-net, secret wildcard-unkin-net-tls, emberstack-
reflected), the remaining single-label public hosts should terminate on the
real publicly-trusted leaf instead of the internal Vault-PKI CA. A *.unkin.net
wildcard only matches single-label subdomains, so cluster hostnames under
*.k8s.syd1.au.unkin.net stay on vault-issuer.

- certificate_wildcard-unkin-net: reflect the secret into arrstack, authentik
  and gitea (append to both reflector namespace lists)
- arrstack: point the public arrproxy gateway (arrstack.unkin.net) at
  wildcard-unkin-net-tls and drop its vault-issuer annotations
- authentik: point the identity.unkin.net listener at wildcard-unkin-net-tls;
  the identity.k8s.syd1.au.unkin.net listeners keep authentik-tls, so the
  gateway common-name is retargeted to the cluster host
- gitea: secret reflected only; git.unkin.net cutover deferred (no manifest
  change), same deferred pattern as fafflix

apps/base/authentik/gateway.yaml

@@ -1,4 +1,9 @@
 ---
+# The public identity.unkin.net listener terminates TLS with the real Let's
+# Encrypt *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
+# reflected here as wildcard-unkin-net-tls). The cluster-hostname listeners
+# (identity.k8s.syd1.au.unkin.net) keep the Vault-PKI authentik-tls, whose
+# cert-manager annotations below now key the common-name off that cluster host.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -6,7 +11,7 @@ metadata:
     traefik.io/instance: internal
   annotations:
     cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: identity.unkin.net
+    cert-manager.io/common-name: identity.k8s.syd1.au.unkin.net
     cert-manager.io/private-key-size: "4096"
     external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
@@ -33,7 +38,7 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: authentik-tls
+            name: wildcard-unkin-net-tls
         mode: Terminate
     - allowedRoutes:
         namespaces: