fix(fc-php): restore missing IngressRoute + TLS cert (php-web 404 on GX10)

php.iamworkin.lan returned 404 on every path: the GX10 GitOps capture grabbed
fc-php's deployment/service but NOT its IngressRoute (chicken-egg — php wasn't
routed at capture time), so Traefik matched no route. Pod is 1/1 Running 37h —
the 404 was pure missing-route, confirmed by diffing against the healthy sibling
mysql-web (which has its IngressRoute).

Mirrors the mysql-web / fc-network pattern: a cert-manager Certificate (step-ca-acme
ClusterIssuer) to mint php-web-tls + an IngressRoute Host(php.iamworkin.lan)->php-web:5400.
Additive only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps-gx10/fc-php/certificate-php-web-tls.json

@@ -0,0 +1,18 @@
+{
+  "apiVersion": "cert-manager.io/v1",
+  "kind": "Certificate",
+  "metadata": {
+    "name": "php-web-tls",
+    "namespace": "fc-php"
+  },
+  "spec": {
+    "dnsNames": [
+      "php.iamworkin.lan"
+    ],
+    "issuerRef": {
+      "kind": "ClusterIssuer",
+      "name": "step-ca-acme"
+    },
+    "secretName": "php-web-tls"
+  }
+}

apps-gx10/fc-php/ingressroute-php-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "php-web",
+    "namespace": "fc-php"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`php.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "php-web",
+            "port": 5400
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "php-web-tls"
+    }
+  }
+}