feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA

Ingress:
- Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder
- HTTPS termination with mkcert (local) / rustls-acme (production)
- Host-prefix routing with path-based sub-routing for auth virtual host:
  /oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui
- HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub
- cert-manager HTTP-01 ACME challenge routing via Ingress watcher
- RBAC for Ingress watcher (pingora-watcher ClusterRole)
- local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict

Infrastructure:
- socket_vmnet shared network for host↔VM reachability (192.168.105.2)
- local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution
- Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods
- Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25
- Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values

overlays/production/kustomization.yaml

@@ -2,8 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 # Production overlay — targets Scaleway Elastic Metal (Paris)
-# Deploy with: kubectl apply -k overlays/production/
-# TODO: fill in all production values before first production deploy
+#
+# Deploy (DOMAIN_SUFFIX and ACME_EMAIL are substituted by sed):
+#   DOMAIN="yourdomain.com" EMAIL="ops@yourdomain.com"
+#   kustomize build overlays/production/ \
+#     | sed -e "s/DOMAIN_SUFFIX/${DOMAIN}/g" -e "s/ACME_EMAIL/${EMAIL}/g" \
+#     | kubectl apply --server-side --force-conflicts -f -
 
 resources:
   - ../../base/mesh
@@ -14,13 +18,17 @@ resources:
   - ../../base/lasuite
   - ../../base/media
   - ../../base/devtools
+  # cert-manager ClusterIssuer + Certificate (requires cert-manager to be installed)
+  - cert-manager.yaml
+
+images:
+  # Set to your container registry. DOMAIN_SUFFIX is substituted by sed.
+  - name: sunbeam-proxy
+    newName: src.DOMAIN_SUFFIX/sunbeam/sunbeam-proxy
+    newTag: latest
 
 patches:
-  # TODO: set domain to sunbeam.pt
-  # - path: values-domain.yaml
-
-  # TODO: enable rustls-acme + Let's Encrypt, bind to public IP
-  # - path: values-pingora.yaml
+  - path: values-pingora.yaml
 
   # TODO: set OIDC redirect URIs to https://*.sunbeam.pt/...
   # - path: values-ory.yaml