fleet-manager: add acme side-car for the admin-UI cert (LE DNS-01 via Route 53)

Auto-issue + auto-renew the admin-UI TLS cert with a long-running compose
side-car instead of a host cron. The `acme` service (goacme/lego image, running
acme/renew-loop.sh) obtains the cert over DNS-01 via the AWS Route 53 API,
writes fullchain/privkey into ./pki/admin/ — the SAME dir the manager reads
(./pki:/pki:ro) — and chowns them to the nonroot runtime uid so the read-only
container can load the key. The manager's certReloader hot-swaps on the mtime
bump, no restart. Loop renews within 30 days of expiry; ACME_STAGING=1 gives a
dry-run vs LE staging.

- docker-compose.yml: `acme` service + `acme-state` volume (lego account/cert
  store). ACME_DOMAIN reuses FLEET_MGR_RP_ID so cert host == passkey origin.
- .env.example: ACME_EMAIL + AWS creds (or instance role) + ACME_STAGING.
- DEPLOY.md §2c: rewritten to the side-car flow — scoped Route 53 IAM policy,
  bring-acme-up-first ordering, flip off insecure, and an origin-match note.

(The docker-compose.yml commit also carries the local harbor.bitasylum.org
influxdb image mirror edit.)

serving/fleet-manager/docker-compose.yml

@@ -27,7 +27,7 @@
 services:
   # --- metrics store (private; only the manager reads/writes it) --------------
   influxdb:
-    image: influxdb:2.7
+    image: harbor.bitasylum.org/dockerhub/library/influxdb:2.7
     restart: unless-stopped
     # Publish to loopback only — the host-networked manager reaches it at
     # 127.0.0.1:8086; it is never on the boot/mgmt LAN.
@@ -107,12 +107,40 @@ services:
       - fleet-data:/data
       # PKI, read-only: admin LE cert, agent-plane fleet-CA server cert, and the
       # broker admin-client cert. See DEPLOY.md / server-pki.sh for what lands here.
+      # The admin LE cert under ./pki/admin/ is produced by the `acme` side-car.
       - ./pki:/pki:ro
 
+  # --- admin-UI cert renewal side-car (Let's Encrypt DNS-01 via Route 53) -----
+  # Long-running "compose cron": issues the UI cert on first start, then renews
+  # within 30 days of expiry. Writes into ./pki/admin/ — the SAME dir the manager
+  # reads (./pki:/pki:ro) — so the manager hot-reloads it with no restart. Needs
+  # outbound reach to Let's Encrypt + the AWS Route 53 API (bridge NAT).
+  # Bring this up BEFORE the manager (or the manager crash-loops until the cert
+  # exists, then self-heals). See DEPLOY.md §2c.
+  acme:
+    image: goacme/lego:v4.17.4       # mirror via harbor if no dockerhub egress
+    restart: unless-stopped
+    entrypoint: ["/bin/sh", "/renew-loop.sh"]
+    environment:
+      ACME_DOMAIN: "${FLEET_MGR_RP_ID:?set FLEET_MGR_RP_ID in .env}"  # = the UI hostname
+      ACME_EMAIL: "${ACME_EMAIL:?set ACME_EMAIL in .env}"
+      ACME_STAGING: "${ACME_STAGING:-}"                               # set 1 for a dry-run
+      # AWS creds for the Route 53 DNS-01 challenge (or omit + use an instance role).
+      AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID:-}"
+      AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY:-}"
+      AWS_REGION: "${AWS_REGION:-us-east-1}"
+    volumes:
+      - ./acme/renew-loop.sh:/renew-loop.sh:ro
+      - acme-state:/le               # lego account + cert store — PERSIST
+      - ./pki/admin:/out             # shared with the manager's ./pki/admin
+    networks:
+      - fleet-mgmt
+
 volumes:
   influx-data:
   influx-config:
   fleet-data:
+  acme-state:
 
 networks:
   fleet-mgmt: