T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/cert-manager/README.md

@@ -0,0 +1,34 @@
+# platform/cert-manager
+
+**cert-manager** — trusted TLS via **Let's Encrypt**, **ACME DNS-01** (Cloudflare).
+
+- **Governing ADR:** [ADR-0006 — TLS: cert-manager + Let's Encrypt (DNS-01)](../../../home-network-k3s/decisions/adr-0006-tls-cert-manager-letsencrypt.md)
+- **Spec:** [docs/08 — TLS & Certificates](../../../home-network-k3s/docs/08-tls-and-certificates.md),
+  [docs/09 — DNS & Ingress](../../../home-network-k3s/docs/09-dns-and-ingress.md)
+- **Serves:** R-TLS-01/02/03, R-DNS-01
+- **Owner:** WS-SEC
+
+## What this stub is
+
+Flux `HelmRelease` + **two `ClusterIssuer`s** (`letsencrypt-staging`, `letsencrypt-prod` — both
+mandated by ADR-0006). DNS-01 against the `keithjackson.dev` zone validates domain control **without
+exposing the service** (works for internal-only services, R-TLS-03) and enables the **wildcard**
+`*.home.keithjackson.dev` cert defined in [`../gateway`](../gateway).
+
+## Contract (Issuer + Gateway TLS)
+
+Part of the "Issuer + Gateway TLS" interface (`roadmap/workstreams.md`, WS-SEC + WS-NET): the wildcard
+`Certificate` (in `gateway/`) references the issuer named by `${ACME_CLUSTER_ISSUER}` and its secret
+is consumed by the Gateway HTTPS listener.
+
+## Secrets
+
+The Cloudflare API token is referenced **by name** (`cloudflare-api-token`) and committed
+**SOPS-encrypted** (WS-SEC, OQ-4, ADR-0007). **No plaintext token in git.**
+
+## TODO (later phases)
+
+- **OQ-4 (resolved to Cloudflare):** WS-SEC provisions the scoped Cloudflare token, SOPS-encrypted.
+- Set the ACME account email.
+- **Phase 2 (WS-SEC):** issue the wildcard cert; prove a trusted, non-self-signed cert at
+  `*.home.keithjackson.dev` (R-TLS-01/03, Phase-2 exit gate).