T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/cert-manager/clusterissuers.yaml

@@ -0,0 +1,48 @@
+---
+# ClusterIssuers — Let's Encrypt via ACME DNS-01 against the keithjackson.dev zone (Cloudflare).
+# ADR-0006 mandates BOTH a staging issuer (bring-up) and a prod issuer. DNS-01 enables wildcard
+# certs and does NOT require exposing the service (works for internal-only services, R-TLS-03).
+#
+# Phase 0 STUB: emails/tokens are placeholders. The Cloudflare API token is referenced BY NAME only
+# and will be committed SOPS-encrypted (OQ-4, ADR-0007) — NO plaintext secret here.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: [email protected]        # TODO(WS-SEC): ACME account email
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token       # SOPS-encrypted (WS-SEC) — name only
+              key: api-token
+        selector:
+          dnsZones:
+            - "keithjackson.dev"
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]        # TODO(WS-SEC): ACME account email
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token       # SOPS-encrypted (WS-SEC) — name only
+              key: api-token
+        selector:
+          dnsZones:
+            - "keithjackson.dev"
+# The active issuer per environment is chosen via ${ACME_CLUSTER_ISSUER} (cluster-vars):
+# dev -> letsencrypt-staging, prod -> letsencrypt-prod (R-ENV-02). See gateway/ wildcard Certificate.