Extend the LE *.unkin.net wildcard to arrstack + authentik (reflect into gitea)

why: after #417 stood up the central Let's Encrypt *.unkin.net wildcard
(Certificate wildcard-unkin-net, secret wildcard-unkin-net-tls, emberstack-
reflected), the remaining single-label public hosts should terminate on the
real publicly-trusted leaf instead of the internal Vault-PKI CA. A *.unkin.net
wildcard only matches single-label subdomains, so cluster hostnames under
*.k8s.syd1.au.unkin.net stay on vault-issuer.

- certificate_wildcard-unkin-net: reflect the secret into arrstack, authentik
  and gitea (append to both reflector namespace lists)
- arrstack: point the public arrproxy gateway (arrstack.unkin.net) at
  wildcard-unkin-net-tls and drop its vault-issuer annotations
- authentik: point the identity.unkin.net listener at wildcard-unkin-net-tls;
  the identity.k8s.syd1.au.unkin.net listeners keep authentik-tls, so the
  gateway common-name is retargeted to the cluster host
- gitea: secret reflected only; git.unkin.net cutover deferred (no manifest
  change), same deferred pattern as fafflix

apps/base/cert-manager/certificate_wildcard-unkin-net.yaml

@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea"
   privateKey:
     size: 4096
   dnsNames: