System services (dashboard, keycloak) need HTTP→HTTPS redirect through
the acme-challenge Gateway. Since system namespaces have the
cozystack.io/system label, their HTTPRoutes can attach to the
acme-challenge Gateway (from: Selector).
Tenant services use the http-redirect Gateway (from: Same) for redirect.
This keeps the security model intact: only system namespaces can attach
to acme-challenge, only the gateway's own namespace can attach to
http-redirect.
Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
07d841b60e