fix: serve a leaf certificate, not the CA

LibreChat served the lab CA's own certificate as its server certificate — a
CA:TRUE certificate valid for the whole *.sttlab.local wildcard, from a
hand-made tls.yaml that also carried the CA's private key. Gitignored, so never
leaked, but the only service in the estate still copying the CA around instead
of being issued a leaf.

Now a cert-manager Certificate for librechat.sttlab.local: CA:FALSE, one
dnsNames, key generated in the cluster and rotated there.

The two uses of that Secret had to be separated first, which is the part worth
knowing: sttlab-tls was both the ingress certificate and the CA bundle mounted
as NODE_EXTRA_CA_CERTS for outbound calls. Replacing it with a leaf alone would
have left LibreChat unable to verify Keycloak. The CA certificate now comes from
ca-configmap.yaml — the certificate, never the key, committed like the agents'.

Verified: the ingress serves CA:FALSE with SAN librechat.sttlab.local, the pod's
outbound call to Keycloak returns 200 with TLS verified, and the old secret is
deleted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/README.md

@@ -44,7 +44,8 @@ k8s/
 │   └── service.yaml
 └── ingress/
     ├── ingress.yaml
-    └── tls.yaml               TLS secret (gitignored — never commit)
+    ├── certificate.yaml       cert-manager Certificate → librechat-tls
+    └── (no TLS file: the key is generated in the cluster)
 ```
 
 ## Prerequisites
@@ -72,19 +73,22 @@ openssl rand -hex 8       # CREDS_IV
 mongodb://librechat:<password>@mongodb:27017/LibreChat?authSource=admin
 ```
 
-### 2. Create the TLS secret
+### 2. TLS
 
-```bash
-kubectl apply -f k8s/namespace.yaml
+Nothing to create. `ingress/certificate.yaml` asks cert-manager for a leaf
+certificate for `librechat.sttlab.local`, issued by the `sttlab-local-ca`
+ClusterIssuer into the `librechat-tls` Secret. The private key is generated in
+the cluster, rotated automatically, and never exists as a file.
 
-kubectl create secret tls sttlab-tls \
-  --cert=$HOME/tls/sttlab.pc.crt \
-  --key=$HOME/tls/sttlab.pc.key \
-  --namespace=librechat \
-  --dry-run=client -o yaml > k8s/ingress/tls.yaml
+This replaced a hand-made `tls.yaml` holding the lab CA's own certificate *and
+private key*, which LibreChat then served as its server certificate — a
+`CA:TRUE` certificate valid for the whole `*.sttlab.local` wildcard where a leaf
+for one name is what a server needs.
 
-kubectl apply -f k8s/ingress/tls.yaml
-```
+The CA **certificate** is still needed, for the outbound calls LibreChat makes
+to Keycloak and the domain gateways. It lives in `ca-configmap.yaml`, is mounted
+as `NODE_EXTRA_CA_CERTS`, and is committed — a certificate is public by
+construction; the key is what must never be in a file.
 
 ### 3. Deploy