feat(bootstrap): add Phase 1c nginx ingress controller

- Add p1_ingress() phase to install nginx-ingress-controller
- Create ingress-nginx namespace with privileged PodSecurity label
- Disable ServiceMonitor during bootstrap (Prometheus CRDs not installed yet)
- Add namespace.yaml with PodSecurity labels (allows hostPort)
- Filter cert-manager CRD errors (will be created by ArgoCD)
- Include ingress phase in bootstrap 'all' flow

bootstrap.sh

@@ -81,6 +81,34 @@ p1_longhorn() {
   fi
 }
 
+p1_ingress() {
+  phase "PHASE 1c: INGRESS (Nginx Ingress Controller)"
+  
+  # Install nginx-ingress if not present
+  if kubectl get ingressclass nginx >/dev/null 2>&1; then
+    log "nginx IngressClass present, skip install"
+    return
+  fi
+  
+  # Always ensure namespace with PodSecurity labels (idempotent)
+  kubectl apply -f "$BOOT/ingress/namespace.yaml"
+  
+  ensure_helm_repo ingress-nginx https://kubernetes.github.io/ingress-nginx
+  log "Installing nginx-ingress controller (this may take 2-3 minutes)..."
+  if helm install ingress-nginx ingress-nginx/ingress-nginx -n ingress-nginx \
+    --values "$BOOT/ingress/nginx-values.yaml" --timeout 5m; then
+    log "✅ nginx-ingress installed"
+  else
+    log "❌ nginx-ingress install failed"
+    return 1
+  fi
+  
+  # Apply additional ingress resources (cert, ingress rules)
+  log "Applying ingress manifests (ignoring cert-manager CRD errors)..."
+  kubectl apply -k "$BOOT/ingress/" 2>&1 | grep -v "no matches for kind" || true
+  log "✅ Ingress resources applied (cert-manager resources will be created by ArgoCD)"
+}
+
 p2_cnpg() {
   phase "PHASE 2: CNPG OPERATOR"
   if kubectl get crd clusters.postgresql.cnpg.io >/dev/null 2>&1; then log "cnpg CRD present, skip install"; return; fi
@@ -233,13 +261,14 @@ p5_cutover() {
 }
 
 case "${1:-all}" in
-  all)      preflight; p1_cilium; p1_longhorn; p2_cnpg; p3_forgejo; p4_argocd
+  all)      preflight; p1_cilium; p1_longhorn; p1_ingress; p2_cnpg; p3_forgejo; p4_argocd
             log "Phases 1-4 done. Push repo to Forgejo + set up pull-mirror, then: $0 cutover" ;;
   cilium)   preflight; p1_cilium ;;
   storage)  preflight; p1_longhorn ;;
+  ingress)  preflight; p1_ingress ;;
   cnpg)     preflight; p2_cnpg ;;
   forgejo)  preflight; p3_forgejo ;;
   argocd)   preflight; p4_argocd ;;
   cutover)  preflight; p5_cutover ;;
-  *) echo "usage: $0 {all|cilium|storage|cnpg|forgejo|argocd|cutover}"; exit 1 ;;
+  *) echo "usage: $0 {all|cilium|storage|ingress|cnpg|forgejo|argocd|cutover}"; exit 1 ;;
 esac

k8s/bootstrap/ingress/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

k8s/bootstrap/ingress/nginx-values.yaml

@@ -79,10 +79,11 @@ controller:
   # every exposed service in the cluster goes through here, so this single block
   # is the cluster-wide "latency and availability" signal. Prometheus auto-discovers
   # the ServiceMonitor (serviceMonitorSelectorNilUsesHelmValues: false in prometheus-values.yaml).
+  # NOTE: ServiceMonitor disabled during bootstrap (Prometheus CRDs not installed yet)
   metrics:
     enabled: true
     serviceMonitor:
-      enabled: true
+      enabled: false  # Will be enabled by ArgoCD after Prometheus CRDs are installed
       namespace: ingress-nginx
       interval: 30s
       scrapeTimeout: 30s