Let cert-manager issue the certificate

The ingress pointed at scottyah-tls, a secret hand-copied between
namespaces and absent from this one, so Traefik fell back to a
self-signed certificate. That is invisible behind Cloudflare until the
SSL mode is set to Full (strict), which then fails with a 526.

Issue into the namespace over DNS-01 instead. Nothing to copy, and the
renewal is no longer a thing anyone has to remember.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s.yaml

@@ -137,12 +137,19 @@ metadata:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     traefik.ingress.kubernetes.io/router.middlewares: fit-fit-basic-auth@kubernetescrd
+    # cert-manager watches the tls block below and issues into this namespace,
+    # over DNS-01 at Cloudflare. A TLS secret cannot be shared across
+    # namespaces, and hand-copying one leaves a certificate nothing renews.
+    cert-manager.io/cluster-issuer: letsencrypt-prod-cloudflare
 spec:
   ingressClassName: traefik
   tls:
     - hosts:
         - fit.scottyah.com
-      secretName: scottyah-tls
+      # Created and renewed by cert-manager. It does not exist until the
+      # first issue succeeds, and the site does not serve a valid cert
+      # until then.
+      secretName: fit-tls
   rules:
     - host: fit.scottyah.com
       http: