fix(comfyui): correct port 8188->18188, add TLS ingress at comfyui.riotpiao.com

ai-dock image runs ComfyUI on port 18188 (10000+8188), not 8188.
Caddy in the image doesn't proxy 8188->18188, so probes and service
must target 18188 directly. This caused 273 startup probe failures
and constant restarts over 45h.

- deployment: containerPort, probes, env all point to 18188
- service: targetPort 18188
- ingress: TLS via letsencrypt, WebSocket upgrade headers for live preview
- CoreDNS: rewrite comfyui.riotpiao.com to nginx controller

k8s/apps/comfyui/ingress.yaml

@@ -4,16 +4,24 @@ metadata:
   name: comfyui
   namespace: comfyui
   annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     # WebSocket support for ComfyUI's live preview
     nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
-    nginx.ingress.kubernetes.io/proxy-set-headers: "Upgrade"
+    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
 spec:
   ingressClassName: nginx
+  tls:
+    - secretName: comfyui-tls
+      hosts:
+        - comfyui.riotpiao.com
   rules:
-    - host: comfy.riotpiao.com
+    - host: comfyui.riotpiao.com
       http:
         paths:
           - path: /