feat(bootstrap): add Phase 1c nginx ingress controller

- Add p1_ingress() phase to install nginx-ingress-controller
- Create ingress-nginx namespace with privileged PodSecurity label
- Disable ServiceMonitor during bootstrap (Prometheus CRDs not installed yet)
- Add namespace.yaml with PodSecurity labels (allows hostPort)
- Filter cert-manager CRD errors (will be created by ArgoCD)
- Include ingress phase in bootstrap 'all' flow

k8s/bootstrap/ingress/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

k8s/bootstrap/ingress/nginx-values.yaml

@@ -79,10 +79,11 @@ controller:
   # every exposed service in the cluster goes through here, so this single block
   # is the cluster-wide "latency and availability" signal. Prometheus auto-discovers
   # the ServiceMonitor (serviceMonitorSelectorNilUsesHelmValues: false in prometheus-values.yaml).
+  # NOTE: ServiceMonitor disabled during bootstrap (Prometheus CRDs not installed yet)
   metrics:
     enabled: true
     serviceMonitor:
-      enabled: true
+      enabled: false  # Will be enabled by ArgoCD after Prometheus CRDs are installed
       namespace: ingress-nginx
       interval: 30s
       scrapeTimeout: 30s