fix: serve a leaf certificate, not the CA

LibreChat served the lab CA's own certificate as its server certificate — a
CA:TRUE certificate valid for the whole *.sttlab.local wildcard, from a
hand-made tls.yaml that also carried the CA's private key. Gitignored, so never
leaked, but the only service in the estate still copying the CA around instead
of being issued a leaf.

Now a cert-manager Certificate for librechat.sttlab.local: CA:FALSE, one
dnsNames, key generated in the cluster and rotated there.

The two uses of that Secret had to be separated first, which is the part worth
knowing: sttlab-tls was both the ingress certificate and the CA bundle mounted
as NODE_EXTRA_CA_CERTS for outbound calls. Replacing it with a leaf alone would
have left LibreChat unable to verify Keycloak. The CA certificate now comes from
ca-configmap.yaml — the certificate, never the key, committed like the agents'.

Verified: the ingress serves CA:FALSE with SAN librechat.sttlab.local, the pod's
outbound call to Keycloak returns 200 with TLS verified, and the old secret is
deleted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/librechat/deployment.yaml

@@ -136,7 +136,7 @@ spec:
             # NODE_TLS_REJECT_UNAUTHORIZED=0 which would disable TLS
             # verification globally.
             - name: NODE_EXTRA_CA_CERTS
-              value: /etc/sttlab-tls/tls.crt
+              value: /etc/sttlab-ca/ca.crt
             # 512Mi was too tight for LibreChat under real use (MCP clients,
             # OTel instrumentation) and caused repeated V8 heap-limit crashes.
             # Cap old-space explicitly, leaving headroom under the new
@@ -166,16 +166,13 @@ spec:
             - name: app-config
               mountPath: /app/librechat.yaml
               subPath: librechat.yaml
-            - name: sttlab-tls-cert
-              mountPath: /etc/sttlab-tls
+            - name: sttlab-ca
+              mountPath: /etc/sttlab-ca
               readOnly: true
       volumes:
         - name: app-config
           configMap:
             name: librechat-app-config
-        - name: sttlab-tls-cert
-          secret:
-            secretName: sttlab-tls
-            items:
-              - key: tls.crt
-                path: tls.crt
+        - name: sttlab-ca
+          configMap:
+            name: sttlab-ca