The ServiceMonitor CRD (monitoring.coreos.com) is not installed because this
cluster runs a standalone Prometheus deployment, not the Prometheus Operator.
The manifest itself noted 'only apply if Prometheus Operator is installed'.
Removing it unblocks the phoenix app sync.
The ingresses referenced a Cloudflare OriginIssuer 'prod-issuer' whose CRD
and controller are not installed in the cluster, so cert-manager could not
issue certs and Traefik served a default cert (invalid SSL). Switch to the
existing letsencrypt-prod ClusterIssuer with specific hostnames + per-app
secrets, matching the working ingresses (http-01 cannot issue wildcards).
