Ingress and TLS for the api runtime

[FullFran]

Expose the api runtime with TLS.

Scope

• Ingress controller installed (ingress-nginx or Traefik — Traefik is already
  familiar from the Dokploy setup, which is a reason to consider it)
• Ingress resource for the api Service
• TLS via cert-manager with automatic Let's Encrypt issuance and renewal
• HTTP to HTTPS redirect
• Rate limiting at the ingress layer
• Confirm helmet headers survive the proxy hop

Notes

This is the step where the mental model from Traefik on Dokploy maps directly
onto Kubernetes: Ingress is the same job as a Traefik router, and cert-manager
is the same job as its ACME resolver. Worth writing that mapping down in the
docs — it is exactly the translation an interviewer probes for.