fix(ingress): correct broken/mismatched backends found in full audit

- minio console ingress: minio-console -> minio-cluster-console:9090 (service renamed by operator)
- minio-api ingress: point to minio:9000 (restored once requestAutoCert disabled)
- minio tenant: requestAutoCert: false (MinIO was TLS-only internally, breaking
  plain-HTTP clients like Vault's S3 backend - this was the real cause of the
  Vault S3 hang)
- argocd ingress: moved from namespace cicd -> argocd (service lives in argocd
  namespace; ingress in wrong namespace can never route, was returning 503)
- removed duplicate kmsvc ingress (sqs namespace already has management-service
  ingress with proper TLS block for same host/backend)

Audit method: cross-checked every ingress backend.service.{name,port} against
actual Service objects in cluster. Found 3 broken backends out of 15 ingresses.

k8s/infrastructure/minio/minio-tenant.yaml

@@ -13,6 +13,13 @@ metadata:
 spec:
   image: minio/minio:RELEASE.2025-07-23T15-54-02Z
 
+  # Disable operator auto-TLS: MinIO serves plain HTTP internally on 9000.
+  # External TLS is terminated at nginx ingress (wildcard riotpiao-com-tls cert).
+  # Without this, MinIO auto-generates self-signed certs and serves HTTPS-only
+  # on 9000, which breaks plain-HTTP internal clients like Vault's S3 backend
+  # (they hang waiting for a TLS handshake that never completes on an HTTP request).
+  requestAutoCert: false
+
   # Root credentials. v5 pods read `configuration` — a Secret whose `config.env`
   # key holds shell `export MINIO_ROOT_USER=...` lines. Created out-of-band
   # (SOPS), see minio-secrets.enc.yaml. NOTE: the operator health-monitor logs a