feat(bootstrap): add Phase 1c nginx ingress controller

bootstrap.sh

@@ -81,6 +81,34 @@ p1_longhorn() {
   fi
 }
 
+p1_ingress() {
+  phase "PHASE 1c: INGRESS (Nginx Ingress Controller)"
+  
+  # Install nginx-ingress if not present
+  if kubectl get ingressclass nginx >/dev/null 2>&1; then
+    log "nginx IngressClass present, skip install"
+    return
+  fi
+  
+  # Always ensure namespace with PodSecurity labels (idempotent)
+  kubectl apply -f "$BOOT/ingress/namespace.yaml"
+  
+  ensure_helm_repo ingress-nginx https://kubernetes.github.io/ingress-nginx
+  log "Installing nginx-ingress controller (this may take 2-3 minutes)..."
+  if helm install ingress-nginx ingress-nginx/ingress-nginx -n ingress-nginx \
+    --values "$BOOT/ingress/nginx-values.yaml" --timeout 5m; then
+    log "✅ nginx-ingress installed"
+  else
+    log "❌ nginx-ingress install failed"
+    return 1
+  fi
+  
+  # Apply additional ingress resources (cert, ingress rules)
+  log "Applying ingress manifests (ignoring cert-manager CRD errors)..."
+  kubectl apply -k "$BOOT/ingress/" 2>&1 | grep -v "no matches for kind" || true
+  log "✅ Ingress resources applied (cert-manager resources will be created by ArgoCD)"
+}
+
 p2_cnpg() {
   phase "PHASE 2: CNPG OPERATOR"
   if kubectl get crd clusters.postgresql.cnpg.io >/dev/null 2>&1; then log "cnpg CRD present, skip install"; return; fi
@@ -233,13 +261,14 @@ p5_cutover() {
 }
 
 case "${1:-all}" in
-  all)      preflight; p1_cilium; p1_longhorn; p2_cnpg; p3_forgejo; p4_argocd
+  all)      preflight; p1_cilium; p1_longhorn; p1_ingress; p2_cnpg; p3_forgejo; p4_argocd
             log "Phases 1-4 done. Push repo to Forgejo + set up pull-mirror, then: $0 cutover" ;;
   cilium)   preflight; p1_cilium ;;
   storage)  preflight; p1_longhorn ;;
+  ingress)  preflight; p1_ingress ;;
   cnpg)     preflight; p2_cnpg ;;
   forgejo)  preflight; p3_forgejo ;;
   argocd)   preflight; p4_argocd ;;
   cutover)  preflight; p5_cutover ;;
-  *) echo "usage: $0 {all|cilium|storage|cnpg|forgejo|argocd|cutover}"; exit 1 ;;
+  *) echo "usage: $0 {all|cilium|storage|ingress|cnpg|forgejo|argocd|cutover}"; exit 1 ;;
 esac