Extend the LE *.unkin.net wildcard to arrstack + authentik (reflect into gitea)

why: after #417 stood up the central Let's Encrypt *.unkin.net wildcard
(Certificate wildcard-unkin-net, secret wildcard-unkin-net-tls, emberstack-
reflected), the remaining single-label public hosts should terminate on the
real publicly-trusted leaf instead of the internal Vault-PKI CA. A *.unkin.net
wildcard only matches single-label subdomains, so cluster hostnames under
*.k8s.syd1.au.unkin.net stay on vault-issuer.

- certificate_wildcard-unkin-net: reflect the secret into arrstack, authentik
  and gitea (append to both reflector namespace lists)
- arrstack: point the public arrproxy gateway (arrstack.unkin.net) at
  wildcard-unkin-net-tls and drop its vault-issuer annotations
- authentik: point the identity.unkin.net listener at wildcard-unkin-net-tls;
  the identity.k8s.syd1.au.unkin.net listeners keep authentik-tls, so the
  gateway common-name is retargeted to the cluster host
- gitea: secret reflected only; git.unkin.net cutover deferred (no manifest
  change), same deferred pattern as fafflix

apps/base/arrstack/arrproxy/gateway.yaml

@@ -1,9 +1,11 @@
 ---
 # External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
-# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
+# external Traefik (LB VIP 198.18.199.0). The apex arrstack.unkin.net A record
-# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
+# lives in the bind-operator unkin.net zone (bind-internal/authoritative), NOT
-# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
+# external-dns, so no external-dns annotation here. Public TLS is terminated with
-# NOT external-dns, so no external-dns annotation here.
+# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
+# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
+# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -11,9 +13,6 @@ metadata:
     traefik.io/instance: external
   annotations:
     argocd.argoproj.io/sync-wave: "2"
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: arrstack.unkin.net
-    cert-manager.io/private-key-size: "4096"
   name: arrproxy
   namespace: arrstack
 spec:
@@ -38,4 +37,4 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: arrproxy-gateway-tls
+            name: wildcard-unkin-net-tls

apps/base/authentik/gateway.yaml

@@ -1,4 +1,9 @@
 ---
+# The public identity.unkin.net listener terminates TLS with the real Let's
+# Encrypt *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
+# reflected here as wildcard-unkin-net-tls). The cluster-hostname listeners
+# (identity.k8s.syd1.au.unkin.net) keep the Vault-PKI authentik-tls, whose
+# cert-manager annotations below now key the common-name off that cluster host.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -6,7 +11,7 @@ metadata:
     traefik.io/instance: internal
   annotations:
     cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: identity.unkin.net
+    cert-manager.io/common-name: identity.k8s.syd1.au.unkin.net
     cert-manager.io/private-key-size: "4096"
     external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
@@ -33,7 +38,7 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: authentik-tls
+            name: wildcard-unkin-net-tls
         mode: Terminate
     - allowedRoutes:
         namespaces:

apps/base/cert-manager/certificate_wildcard-unkin-net.yaml

@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea"
   privateKey:
     size: 4096
   dnsNames: