Switch from homelab.local to coreworlds.io with split-horizon DNS and LAN-only access controls

- Migrate all ingress hostnames from *.homelab.local to *.coreworlds.io
- Remove broken Traefik certresolver config (cert-manager handles TLS)
- Add internal-only IP allowlist middleware for platform services
- Add IngressRoutes for ArgoCD, Grafana, Longhorn (LAN-only via middleware)
- Seal and add Cloudflare API token for cert-manager DNS-01 challenges
- Update cert-manager ClusterIssuers with real email
- Update k3s TLS SAN to k3s.coreworlds.io
- Rewrite Ubiquiti docs for single-node topology and split-horizon DNS
- Fix seal-secret.sh controller name to match Helm release
- Add UCG DNS setup script using API key auth

infra/ansible/inventory/group_vars/servers.yaml

@@ -6,7 +6,7 @@ k3s_server_args: >-
   --disable=servicelb
   --write-kubeconfig-mode=644
   --tls-san={{ ansible_host }}
-  --tls-san=k3s.homelab.local
+  --tls-san=k3s.coreworlds.io
   --kube-apiserver-arg=audit-log-maxage=30
   --kube-apiserver-arg=audit-log-maxbackup=10
   --kube-apiserver-arg=audit-log-maxsize=100