fleet-manager: finish self-TLS cleanup (compose, env, docs, delete acme/)

Follow the code removal through the rest of the tree now that Traefik owns UI TLS:
- compose: drop FLEET_MGR_ADMIN_BEHIND_PROXY + ADMIN_CERT/_KEY from the manager
  env; correct the ./pki mount comment (agent + broker certs only).
- .env.example: drop the BEHIND_PROXY + cert vars + self-TLS note.
- DEPLOY.md / README: remove the self-TLS "alternative" and the BEHIND_PROXY /
  ADMIN_CERT config rows.
- server-pki.sh: point the admin UI cert at Traefik, not ./pki/admin.
- delete serving/fleet-manager/acme/ (the retired ACME side-car).

serving/fleet-manager/docker-compose.yml

@@ -71,15 +71,12 @@ services:
       influxdb:
         condition: service_healthy
     environment:
-      # admin plane — passkey auth behind the Traefik mgmt ingress: Traefik
-      # terminates the LE cert on :443 and forwards plaintext here on loopback,
-      # so the listener MUST stay private (127.0.0.1) — only Traefik reaches it.
+      # admin plane — passkey auth over PLAINTEXT behind the Traefik mgmt ingress:
+      # Traefik terminates the LE cert on :443 and forwards plaintext here on
+      # loopback, so the listener MUST stay private (127.0.0.1) — only Traefik
+      # reaches it. INSECURE=true is the dev/no-auth escape hatch.
       FLEET_MGR_ADMIN_ADDR: "${FLEET_MGR_ADMIN_ADDR:-127.0.0.1:9500}"
-      FLEET_MGR_ADMIN_BEHIND_PROXY: "${FLEET_MGR_ADMIN_BEHIND_PROXY:-true}"
       FLEET_MGR_ADMIN_INSECURE: "${FLEET_MGR_ADMIN_INSECURE:-false}"
-      # Only used for self-TLS mode (BEHIND_PROXY=false + a cert, no Traefik):
-      FLEET_MGR_ADMIN_CERT: "${FLEET_MGR_ADMIN_CERT:-/pki/admin/fullchain.pem}"
-      FLEET_MGR_ADMIN_KEY: "${FLEET_MGR_ADMIN_KEY:-/pki/admin/privkey.pem}"
       # WebAuthn RP — MUST be the UI's real origin (origin-bound passkeys). Behind
       # Traefik on :443 this is the PORT-LESS https origin.
       FLEET_MGR_RP_ID: "${FLEET_MGR_RP_ID:?set FLEET_MGR_RP_ID in .env}"
@@ -113,9 +110,8 @@ services:
     volumes:
       # Durable state (inventory + admin passkeys + enrol key). Back this up.
       - fleet-data:/data
-      # PKI, read-only: admin LE cert, agent-plane fleet-CA server cert, and the
-      # broker admin-client cert. See DEPLOY.md / server-pki.sh for what lands here.
-      # The admin LE cert under ./pki/admin/ is produced by the `acme` side-car.
+      # PKI, read-only: agent-plane fleet-CA server cert + the broker admin-client
+      # cert. (UI TLS is Traefik's — no admin cert here.) See DEPLOY.md/server-pki.sh.
       - ./pki:/pki:ro
 
   # --- management-plane ingress (Traefik) — admin UI on :443 ------------------
@@ -132,7 +128,7 @@ services:
   # collide with a boot-LAN nginx :80 on a single-host lab. Route 53 DNS-01 needs
   # no :80. Set the Host() rule in traefik/dynamic/fleet-manager.yml to your UI host.
   traefik:
-    image: traefik:v3.1              # mirror via harbor if no dockerhub egress
+    image: harbor.bitasylum.org/dockerhub/library/traefik:v3.1              # mirror via harbor if no dockerhub egress
     restart: unless-stopped
     network_mode: host
     command: