T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/gateway/wildcard-certificate.yaml

@@ -0,0 +1,18 @@
+---
+# Wildcard certificate `*.home.keithjackson.dev`, terminated at the shared Gateway (ADR-0006 default).
+# Makes onboarding certificate-free. Issued by the env-selected ClusterIssuer (R-ENV-02).
+# Phase 0 STUB — cannot issue without a cluster + Cloudflare token.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-home
+  namespace: gateway
+spec:
+  secretName: wildcard-home-tls        # consumed by the Gateway HTTPS listener below
+  dnsNames:
+    - "*.home.keithjackson.dev"
+    - "home.keithjackson.dev"          # apex for the C2 UI (docs/09)
+  issuerRef:
+    kind: ClusterIssuer
+    # ${ACME_CLUSTER_ISSUER}: dev -> letsencrypt-staging, prod -> letsencrypt-prod (cluster-vars).
+    name: ${ACME_CLUSTER_ISSUER}