chore: migrar Ingress Traefik→NGINX + cascada wildcard cert (sync APERTURA COVE S3)

helm/APP_NAME/templates/ingress.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.ingress.enabled }}
+# Ingress estándar networking.k8s.io/v1 con ingressClassName=nginx.
+# Razón: el cluster tenant nace con rke2-ingress-nginx por default —
+# instalar Traefik añade footprint e inconsistencia respecto al control
+# plane (donde Traefik sí está). NGINX Ingress es más portable y permite
+# que el tenant siga su exit plan sin lock-in.
+# Decisión: APERTURA COVE Sesión 3 (2026-05-19) — ADR-053 §11.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+  annotations:
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: {{ .Values.ingress.proxyBodySize | default "10m" | quote }}
+spec:
+  ingressClassName: {{ .Values.ingress.className | default "nginx" }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host | quote }}
+      secretName: {{ .Values.ingress.tlsSecretName | default "apps-wildcard-tls" }}
+  rules:
+    - host: {{ .Values.ingress.host | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}
+                port:
+                  number: {{ .Values.service.port }}
+{{- end }}