fix(deploy): switch dev to letsencrypt-prod and add HTTP->HTTPS redirect

deploy/k8s/base/ingress.yaml

@@ -15,6 +15,7 @@ metadata:
   name: vncmail-plus
   annotations:
     cert-manager.io/cluster-issuer: CHANGEME
+    traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-to-https@kubernetescrd
 spec:
   ingressClassName: traefik
   tls:

deploy/k8s/overlays/dev/patch-ingress.yaml

@@ -1,14 +1,12 @@
-# dev-k8s cluster confirmed to have a `letsencrypt-staging` ClusterIssuer
-# already (no `letsencrypt-prod` exists there) - staging avoids burning
-# Let's Encrypt's real rate limits while this is still being stood up.
-# vncmail.sandbox.vnc.de DNS does not point here yet either - this is the
-# intended host, not a live one (see VNCMAIL-SETUP.md for what's still open).
+# Dev now uses letsencrypt-prod so the sandbox certificate is trusted by
+# browsers. Both letsencrypt-staging and letsencrypt-prod ClusterIssuers
+# exist on the dev-k8s cluster (see VNCiAC-dev-cluster-runbook.md §7).
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: vncmail-plus
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-staging
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   tls:
     - hosts: