fleet-manager: finish self-TLS cleanup (compose, env, docs, delete acme/)

Follow the code removal through the rest of the tree now that Traefik owns UI TLS:
- compose: drop FLEET_MGR_ADMIN_BEHIND_PROXY + ADMIN_CERT/_KEY from the manager
  env; correct the ./pki mount comment (agent + broker certs only).
- .env.example: drop the BEHIND_PROXY + cert vars + self-TLS note.
- DEPLOY.md / README: remove the self-TLS "alternative" and the BEHIND_PROXY /
  ADMIN_CERT config rows.
- server-pki.sh: point the admin UI cert at Traefik, not ./pki/admin.
- delete serving/fleet-manager/acme/ (the retired ACME side-car).

serving/fleet-manager/DEPLOY.md

@@ -149,12 +149,6 @@ also keeps the WebAuthn secure-context clean.
 > manager binds loopback (`127.0.0.1:9500`) — only Traefik reaches it; never expose
 > that port directly.
 
-> **Self-TLS alternative (no Traefik):** set `FLEET_MGR_ADMIN_BEHIND_PROXY=false`
-> and give the manager a cert at `/pki/admin/{fullchain,privkey}.pem` (e.g. via the
-> `acme/renew-loop.sh` helper under a `harbor.bitasylum.org/dockerhub/goacme/lego`
-> container). The manager then
-> terminates TLS itself and the origin includes the port it listens on.
-
 <a name="network-paths"></a>
 ### Network paths (three planes, three trust stages)