fix(tls): switch dev to LE production issuer so in-cluster clients trust the wildcard cert

oauth2-proxy + Grafana OIDC discovery to keycloak.home.keithjackson.dev failed x509
'unknown authority' — the wildcard was LE-staging (untrusted). Prod issuer is registered
+ Ready; switching ACME_CLUSTER_ISSUER dev override staging->prod re-issues a publicly
trusted cert. Needed for functional SSO (R-IDP) + R-TLS-01/03 'trusted'.

NOTE: the trusted-tls conformance test embeds the LE-staging root and must be updated to
the LE production root (ISRG Root X1) / system trust — follow-up.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/dev/kustomization.yaml

@@ -58,10 +58,12 @@ patches:
       - op: replace
         path: /data/CLUSTER_ENV
         value: "dev"
-      # DNS-01 against LE staging while iterating (avoids prod rate limits) — ADR-0006.
+      # DNS-01 via LE PRODUCTION: in-cluster OIDC clients (oauth2-proxy, Grafana) must trust the
+      # wildcard cert for SSO to work; the staging root isn't in any trust store. Prod issuer is
+      # registered + Ready; one wildcard cert is well within LE rate limits — ADR-0006, R-TLS-01/03.
       - op: replace
         path: /data/ACME_CLUSTER_ISSUER
-        value: "letsencrypt-staging"
+        value: "letsencrypt-prod"
       # dev mirrors prod's 3-node topology, so the replicated tier keeps 3 replicas.
       - op: replace
         path: /data/LONGHORN_DEFAULT_REPLICA_COUNT