fix(ingress): remove cert-manager + ssl-redirect, TLS is external

The platform (185.247.187.147) terminates TLS externally before nginx.
HTTP-01 ACME challenge was stuck for 8 days because the platform
globally redirects HTTP→HTTPS before reaching nginx ingress.

Changes:
- Remove cert-manager.io/cluster-issuer: letsencrypt-prod annotation
- Remove tls section (iot-kube5s-ru-tls secret was never created)
- Set ssl-redirect: false (TLS termination is at the edge, not nginx)
- Update comment to document the actual TLS architecture

deployments/k8s/emqx-ws-ingress.yaml

@@ -7,7 +7,9 @@
 # IoT Консоль (UI): https://iot.kube5s.ru/console
 #
 # DNS A-запись: iot.kube5s.ru → 185.247.187.147
-# TLS: cert-manager + letsencrypt-prod, secret=iot-kube5s-ru-tls
+# TLS: терминируется внешним слоем платформы (185.247.187.147).
+#      cert-manager НЕ используется — HTTP-01 challenge недоступен т.к. платформа
+#      глобально редиректит HTTP→HTTPS до nginx.
 #
 # Применение: kubectl apply -f deployments/k8s/emqx-ws-ingress.yaml
 
@@ -34,18 +36,13 @@ metadata:
   namespace: sless
   annotations:
     kubernetes.io/ingress.class: nginx
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
     # WebSocket: nginx-ingress добавляет Upgrade/Connection при proxy-http-version=1.1
     nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
 spec:
   ingressClassName: nginx
-  tls:
-    - hosts:
-        - iot.kube5s.ru
-      secretName: iot-kube5s-ru-tls
   rules:
     - host: iot.kube5s.ru
       http: