fix(ha): enable HTTPS with Let's Encrypt via Cloudflare proxy

- Removed ssl-redirect annotation (now proper HTTPS)
- Added tls section matching other service patterns
- Updated home.junv.cc DNS to use Cloudflare proxy
- Certificate issued by letsencrypt-prod via HTTP-01 through Cloudflare

home-apps/home-assistant.yaml

@@ -0,0 +1,111 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: home-apps
+  name: ha-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-client
+  resources:
+    requests:
+      storage: 10Gi
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ha
+  namespace: home-apps
+  labels:
+    app: ha
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: ha
+  template:
+    metadata:
+      labels:
+        app: ha
+        name: ha
+    spec:
+      containers:
+        - name: ha
+          image: ghcr.io/home-assistant/home-assistant:2026.6
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8123
+              name: web
+              protocol: TCP
+          env:
+            - name: TZ
+              value: "Australia/Melbourne"
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: local-time
+              mountPath: /etc/localtime
+          resources:
+            requests:
+              cpu: 200m
+              memory: 400Mi
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: ha-pvc
+      - name: local-time
+        hostPath:
+            path: /etc/localtime
+            type: File
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: ha
+  namespace: home-apps
+  labels:
+    name: ha
+spec:
+  type: ClusterIP
+  selector:
+    app: ha
+  ports:
+    - name: ha
+      targetPort: web
+      port: 8123
+      protocol: TCP
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ha-ingress
+  namespace: home-apps
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/proxy-body-size: 256m
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - home.junv.cc
+      secretName: home-assistant-tls
+  rules:
+    - host: home.junv.cc
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ha
+                port:
+                  number: 8123