bucket: cert-manager ACME http-solver resources orphaned after deletion #3060

Describe the bug

After deleting a Bucket app CR, cert-manager's temporary ACME HTTP-01 solver resources (cm-acme-http-solver-* Ingress/Pod/Service) remain in the namespace.

Environment

• Cozystack version: v1.4.0-rc.2
• Provider: on-prem (bare-metal)

To Reproduce

1. Create a tenant with seaweedfs: true, deploy Bucket/test.
2. Wait until Ready.
3. Delete the Bucket CR; wait ~120s.
4. kubectl -n <ns> get ingress,svc,pod | grep cm-acme — solver objects remain.

Expected behaviour
No orphaned ACME solver resources remain after the app CR is deleted.

Actual behaviour

ingress/cm-acme-http-solver-xxxxx
pod/cm-acme-http-solver-xxxxx
service/cm-acme-http-solver-xxxxx

Additional context

• Root cause: The solver objects are created by cert-manager to answer an ACME HTTP-01 challenge and are owned by the Challenge/Order → Certificate, not by the app Ingress. If the Certificate never completes (challenge stuck) and the app is deleted, the parent Ingress is removed but the orphaned challenge leaves the solver objects without a live owner to cascade-delete them. The chart never owns them, so Helm/Flux uninstall cannot reap them. The Ingress lives in the vendored bucket-system subchart (packages/apps/bucket/templates/helmrelease.yaml:8-11).
• Proposed fix (two parts):
  • Cleanup: post-delete hook deleting the release's Certificate/Order/Challenge (cert-manager then cascade-removes the solvers) plus a sweep:

    kubectl delete ingress,svc,pod -n {{ .Release.Namespace }} -l acme.cert-manager.io/http01-solver=true || true

  • Preventive: apply the wildcard-cert guard (as Harbor's ingress does) so no per-bucket ACME challenge is issued in wildcard mode.

Found during a create→delete leak sweep of all 22 apps on Cozystack v1.4.0-rc.2.