feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA

Ingress:
- Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder
- HTTPS termination with mkcert (local) / rustls-acme (production)
- Host-prefix routing with path-based sub-routing for auth virtual host:
  /oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui
- HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub
- cert-manager HTTP-01 ACME challenge routing via Ingress watcher
- RBAC for Ingress watcher (pingora-watcher ClusterRole)
- local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict

Infrastructure:
- socket_vmnet shared network for host↔VM reachability (192.168.105.2)
- local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution
- Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods
- Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25
- Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values

overlays/local/values-pingora.yaml

@@ -1,7 +1,6 @@
 # Patch: local Pingora overrides
-# - Disables rustls-acme (ACME negotiation not needed locally)
-# - Mounts mkcert wildcard cert from the pingora-tls Secret
-# - Exposes TURN relay range as hostPort on the Lima VM
+# - ACME disabled (mkcert wildcard cert from pingora-tls Secret)
+# - hostPort for TURN relay range on the Lima VM
 
 apiVersion: apps/v1
 kind: Deployment
@@ -13,10 +12,17 @@ spec:
     spec:
       containers:
         - name: pingora
-          env:
-            - name: ACME_ENABLED
-              value: "false"
+          imagePullPolicy: Never
           ports:
+            # Bind HTTP/HTTPS directly to the Lima VM's host network
+            - name: http
+              containerPort: 80
+              hostPort: 80
+              protocol: TCP
+            - name: https
+              containerPort: 443
+              hostPort: 443
+              protocol: TCP
             # Expose full TURN relay range as hostPort so the Lima VM forwards UDP
             - name: turn-start
               containerPort: 49152
@@ -26,5 +32,6 @@ spec:
               containerPort: 49252
               hostPort: 49252
               protocol: UDP
-          # TLS cert comes from mkcert Secret created by scripts/local-certs.sh
-          # Secret name: pingora-tls, keys: tls.crt / tls.key
+          # acme.enabled = false is the default in pingora-config.yaml.
+          # The mkcert cert Secret (pingora-tls) is created by scripts/local-certs.sh
+          # before kustomize runs, so it is always present on first apply.