feat(get-rhema): expose the S3 API publicly for release uploads

The release runners cannot resolve the in-cluster Service name, so the
binary uploads died on DNS. s3.rhema.rs fronts the same Garage through
Caddy and Traefik, with its own certificate, matching the web face's
shape (Caddy terminates, Traefik routes, bucket by path).

kubernetes/infrastructure/caddy-certificates/certificates.yaml

@@ -162,6 +162,22 @@ spec:
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
+metadata:
+  name: s3-rhema-rs
+  namespace: caddy
+spec:
+  secretName: s3-rhema-rs-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: s3.rhema.rs
+  dnsNames:
+    - s3.rhema.rs
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
 metadata:
   name: www-rhema-rs
   namespace: caddy

kubernetes/infrastructure/caddy/caddyfile.yaml

@@ -142,3 +142,8 @@ data:
       tls /etc/caddy/certs/get-rhema-rs/tls.crt /etc/caddy/certs/get-rhema-rs/tls.key
       reverse_proxy traefik.traefik.svc.cluster.local.:80
     }
+
+    s3.rhema.rs {
+      tls /etc/caddy/certs/s3-rhema-rs/tls.crt /etc/caddy/certs/s3-rhema-rs/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }