fleet-manager: finish self-TLS cleanup (compose, env, docs, delete acme/)

Follow the code removal through the rest of the tree now that Traefik owns UI TLS:
- compose: drop FLEET_MGR_ADMIN_BEHIND_PROXY + ADMIN_CERT/_KEY from the manager
  env; correct the ./pki mount comment (agent + broker certs only).
- .env.example: drop the BEHIND_PROXY + cert vars + self-TLS note.
- DEPLOY.md / README: remove the self-TLS "alternative" and the BEHIND_PROXY /
  ADMIN_CERT config rows.
- server-pki.sh: point the admin UI cert at Traefik, not ./pki/admin.
- delete serving/fleet-manager/acme/ (the retired ACME side-car).

serving/fleet-manager/server-pki.sh

@@ -9,8 +9,8 @@
 # fleet step-ca (serving/dot1x-bench/), the same CA that signs enrolment certs.
 #
 # This does NOT issue:
-#   - the ADMIN-plane UI cert   -> Let's Encrypt DNS-01 (external ACME client;
-#                                  drop fullchain/privkey into ./pki/admin/). See DEPLOY.md.
+#   - the ADMIN-plane UI cert   -> owned by the Traefik ingress (Let's Encrypt
+#                                  DNS-01); the manager never terminates TLS. See DEPLOY.md §2c.
 #   - the manager's BROKER client cert -> ../enrol-broker/admin-pki.sh (admin CA):
 #                                  ../enrol-broker/admin-pki.sh ../dot1x-bench/pki/broker fleet-manager
 #
@@ -66,6 +66,6 @@ echo "  server.crt / server.key   -> FLEET_MGR_AGENT_CERT / _KEY"
 echo "  fleet-ca.crt              -> FLEET_MGR_AGENT_CLIENT_CA (verifies host TPM certs)"
 echo
 echo "next:"
-echo "  - admin UI cert  : Let's Encrypt DNS-01 -> ./pki/admin/{fullchain,privkey}.pem (DEPLOY.md)"
+echo "  - admin UI cert  : owned by the Traefik ingress (LE DNS-01) — DEPLOY.md §2c"
 echo "  - broker client  : ../enrol-broker/admin-pki.sh ../dot1x-bench/pki/broker fleet-manager"
 echo "                     then: cp -r ../dot1x-bench/pki/broker ./pki/broker"