Fix: align ingress base and overlays - single host per environment

infrastructure/platform/networking/ingress/overlays/prod/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 
 resources:
   - ../../base
-  - gitea-service.yaml
 
 namePrefix: prod-
 
@@ -15,26 +14,12 @@ patches:
       - op: replace
         path: /spec/tls/0/hosts/0
         value: bakewise.ai
-      - op: replace
-        path: /spec/tls/0/hosts/1
-        value: gitea.bakewise.ai
-      - op: replace
-        path: /spec/tls/0/hosts/2
-        value: registry.bakewise.ai
-      # NOTE: mail.bakewise.ai TLS is handled by separate mailu ingress
       - op: replace
         path: /spec/tls/0/secretName
         value: bakery-ia-prod-tls-cert
       - op: replace
         path: /spec/rules/0/host
         value: bakewise.ai
-      - op: replace
-        path: /spec/rules/1/host
-        value: gitea.bakewise.ai
-      - op: replace
-        path: /spec/rules/2/host
-        value: registry.bakewise.ai
-      # Mail rule removed - mail ingress is deployed separately via mailu-helm
       - op: add
         path: /metadata/annotations/nginx.ingress.kubernetes.io~1cors-allow-origin
         value: "https://bakewise.ai,https://www.bakewise.ai,https://mail.bakewise.ai,https://registry.bakewise.ai,https://gitea.bakewise.ai"
@@ -49,4 +34,7 @@ patches:
         value: "letsencrypt-production"
       - op: add
         path: /metadata/annotations/cert-manager.io~1acme-challenge-type
-        value: "http01"
+        value: "http01"
+# NOTE: Gitea and Registry ingresses are managed by Gitea Helm chart
+# See infrastructure/cicd/gitea/values-prod.yaml for production ingress configuration
+# NOTE: mail.bakewise.ai is handled by separate mailu ingress