feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA

Ingress:
- Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder
- HTTPS termination with mkcert (local) / rustls-acme (production)
- Host-prefix routing with path-based sub-routing for auth virtual host:
  /oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui
- HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub
- cert-manager HTTP-01 ACME challenge routing via Ingress watcher
- RBAC for Ingress watcher (pingora-watcher ClusterRole)
- local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict

Infrastructure:
- socket_vmnet shared network for host↔VM reachability (192.168.105.2)
- local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution
- Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods
- Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25
- Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values

base/ingress/pingora-rbac.yaml

@@ -0,0 +1,44 @@
+---
+# ServiceAccount used by the Pingora pod.
+# The watcher in sunbeam-proxy uses in-cluster credentials (this SA's token) to
+# watch the pingora-tls Secret and pingora-config ConfigMap for changes.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pingora
+  namespace: ingress
+---
+# Minimal read-only role: list+watch on the two objects that drive cert reloads.
+# Scoped to the ingress namespace by the Role kind (not ClusterRole).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pingora-watcher
+  namespace: ingress
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch"]
+  # Ingresses are watched to route cert-manager HTTP-01 challenges to the
+  # correct per-domain solver pod (one Ingress per challenge, created by
+  # cert-manager with the exact token path and solver Service name).
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pingora-watcher
+  namespace: ingress
+subjects:
+  - kind: ServiceAccount
+    name: pingora
+    namespace: ingress
+roleRef:
+  kind: Role
+  name: pingora-watcher
+  apiGroup: rbac.authorization.k8s.io