feat(helm): Traefik IngressRoute + cert-manager Certificate

Two IngressRoutes (web → http-to-https redirect, websecure → app)
covering all configured hosts. Certificate covers all hosts as SANs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

helm/ezscale-website/templates/certificate.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.ingressRoute.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ .Values.ingressRoute.tls.secretName }}
+  labels: {{- include "ezscale-website.labels" . | nindent 4 }}
+spec:
+  secretName: {{ .Values.ingressRoute.tls.secretName }}
+  issuerRef:
+    kind: ClusterIssuer
+    name: {{ .Values.ingressRoute.tls.issuerName }}
+  dnsNames:
+    {{- range .Values.ingressRoute.hosts }}
+    - {{ . | quote }}
+    {{- end }}
+{{- end }}