Add HTTPS configuration with cert-manager

- cert-manager namespace
- ClusterIssuer for Let's Encrypt (prod and staging)
- HTTPS Ingress for ArgoCD, Gitea, and test-app
- Automatic certificate management

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

manifests/02-cert-manager.yaml

@@ -0,0 +1,35 @@
+# cert-manager installation
+# This will be applied by ArgoCD
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cert-manager
+rules:
+  - apiGroups: ["cert-manager.io"]
+    resources: ["*"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["secrets", "events", "configmaps"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cert-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cert-manager
+subjects:
+  - kind: ServiceAccount
+    name: cert-manager
+    namespace: cert-manager