k8s: pre-issue the production TLS cert for the internal hop

Public traffic terminates TLS at the Pangolin VPS, which then proxies to the
control-plane nodes over https:443 — the pattern every other k3s-backed
Pangolin resource follows — so the cluster needs its own valid certificate for
the production hostnames, not just the staging one.

Add www.bluecapstrategies.com and bluecapstrategies.com to the tls block as
bluecap-website-tls. Safe to do before cutover, and deliberately done now:
letsencrypt-prod solves DNS-01 through Cloudflare, so issuance only needs a
temporary TXT record in the zone. No A record has to point at the cluster and
the live WordPress site is untouched. The Cloudflare token was extended to
cover the zone on 2026-10-09.

Both hostnames are listed because the canonical-host decision is still open;
holding a cert for each keeps either choice available, and the redirect is
configured separately.

Pangolin's edge certificate is HTTP-01 and cannot be pre-issued this way; it
is obtained on the first HTTPS request after DNS moves.

k8s/ingress.yaml

@@ -25,10 +25,26 @@ metadata:
     cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   tls:
-    # Staging only, for now. Production hosts join this list at cutover (see header).
     - hosts:
         - bcs.int.7tl-homelab.com
       secretName: bcs-int-tls
+    # Production hostnames. This is the INTERNAL hop only: public traffic terminates TLS at the
+    # Pangolin VPS, which then proxies to these nodes over https:443 (the pattern every other
+    # k3s-backed Pangolin resource uses), so the cluster needs its own valid cert for these names.
+    #
+    # Safe to issue before cutover and deliberately done so: letsencrypt-prod solves DNS-01 via
+    # Cloudflare, which only needs a temporary TXT record in the zone — no A record has to point
+    # here, and the live WordPress site is unaffected. Pangolin's own edge cert is HTTP-01 and
+    # CANNOT be pre-issued; it is obtained on the first request after DNS moves. See
+    # docs/launch-checklist.md section 1.1.
+    #
+    # Both names are listed because the canonical-host decision (section 1.6) is still open;
+    # holding a cert for each keeps either choice available. The redirect is configured
+    # separately and does not depend on this.
+    - hosts:
+        - www.bluecapstrategies.com
+        - bluecapstrategies.com
+      secretName: bluecap-website-tls
   rules:
     - host: bcs.int.7tl-homelab.com
       http: