feat(proxy): add SSH TCP passthrough and graceful HTTP-only startup

Add optional [ssh] config block that proxies port 22 → Gitea SSH pod,
running on a dedicated thread/runtime matching the cert-watcher pattern.

Also start HTTP-only on first deploy when the TLS cert file doesn't exist
yet — once ACME challenge completes and the cert watcher writes the file,
a graceful upgrade adds the TLS listener without downtime.

Fix ACME watcher to handle InitApply events (kube-runtime v3+) so
Ingresses that existed before the proxy started are picked up correctly.

Signed-off-by: Sienna Meridian Satterwhite <sienna@sunbeam.pt>

src/acme.rs

@@ -43,7 +43,10 @@ pub async fn watch_ingresses(client: Client, routes: AcmeRoutes) {
 
     while let Some(result) = stream.next().await {
         match result {
-            Ok(watcher::Event::Apply(ing)) => {
+            // InitApply fires for each Ingress during the initial list (kube v3+).
+            // Apply fires for subsequent creates/updates.
+            // Both must be handled to catch Ingresses that existed before the proxy started.
+            Ok(watcher::Event::InitApply(ing)) | Ok(watcher::Event::Apply(ing)) => {
                 let mut map = routes.write().unwrap_or_else(|e| e.into_inner());
                 upsert_routes(&ing, &mut map);
             }