stage/prod: bootstrap apps only, prod ksops keys

Bootstrap: cert-manager kargo kargo-infra-pipeline kargo-ci-pipeline kargo-test-env-pipeline kargo-credentials
Other apps arrive via Kargo promotion (dev → test → PR → prod)

infra/traefik-routes/manifests/traefik-dashboard.yaml

@@ -1,19 +0,0 @@
-# Traefik Dashboard IngressRoute
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: traefik-dashboard
-  namespace: kube-system
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`traefik.k3s\..+\.local`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
-      kind: Rule
-      middlewares:
-        - name: sslheader
-          namespace: kube-system
-      services:
-        - name: api@internal
-          kind: TraefikService
-  tls: {}