chart: sync the Ingress TLS certificate from Key Vault for estates without the app routing add-on #130

Situation

The chart's Ingress objects name ingress.tlsSecret and carry the annotation
kubernetes.azure.com/tls-cert-keyvault-uri. Only the AKS app routing add-on turns that annotation
into the Secret. An estate that serves the Ingress objects with ingress-nginx (its own controllers
behind internal load balancers) has no component that creates the Secret, so it is created by hand
from the vault certificate, and it is created again by hand after a reset (namespace deleted) and
at every certificate renewal.

The chart already runs the Key Vault CSI driver for the environment values: memex.keyVaultClasses
renders a SecretProviderClass per class with secretObjects of type Opaque
(templates/memex-portal/secretproviderclass.yaml).

Proposal

An opt-in value, for example ingress.tlsFromKeyVault.certificate: <vault certificate object>,
that renders a second SecretProviderClass (or extends the existing one) with a secretObjects
entry of type kubernetes.io/tls, mapping the certificate object (objectType secret, PEM) to
tls.crt and tls.key under the name ingress.tlsSecret, mounted on the portal pod so that the
driver creates and rotates the Secret. Renewal in the vault then reaches the Secret within the
driver's rotation interval, and a reset needs no hand step.

Acceptance

• On an estate with ingress-nginx and the value set, a fresh namespace receives the TLS Secret from
  the chart alone, and the served chain includes the intermediate certificate.
• A new version of the vault certificate reaches the Secret without a deploy.
• Estates with the app routing add-on are unchanged (value unset by default).

Documented departure on the affected estate: its deviations record names the hand step and this
chart change as the route to retire it.