fix: intake TLS uses Certificate + secretName pattern, not certResolver

k8s/manifests/intake-ingress.yaml

@@ -1,4 +1,18 @@
 ---
+# Certificate for janet.ctz.fyi
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: janet-ctz-fyi-tls
+  namespace: autojanet
+spec:
+  secretName: janet-ctz-fyi-tls
+  dnsNames:
+    - janet.ctz.fyi
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+---
 # IngressRoute: janet.ctz.fyi → intake service
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -15,4 +29,4 @@ spec:
         - name: intake
           port: 80
   tls:
-    certResolver: letsencrypt
+    secretName: janet-ctz-fyi-tls