Cronjob pods were stuck in ImagePullBackOff because they referenced bare
image name 'myorg-assistant:latest' (no registry, no pull secret).
Updated all 5 cronjobs to use git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
matching the Deployment, added gitea-registry imagePullSecrets, and set
imagePullPolicy: Always for consistency.
The ingresses referenced a Cloudflare OriginIssuer 'prod-issuer' whose CRD
and controller are not installed in the cluster, so cert-manager could not
issue certs and Traefik served a default cert (invalid SSL). Switch to the
existing letsencrypt-prod ClusterIssuer with specific hostnames + per-app
secrets, matching the working ingresses (http-01 cannot issue wildcards).
