feat(cluster)!: move cert-manager into kube-system namespace

tmpl/cluster/cert-manager-secret.sops.yaml

@@ -3,6 +3,6 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: cloudflare-api-key
-  namespace: cert-manager
+  namespace: kube-system
 stringData:
     api-key: ${BOOTSTRAP_CLOUDFLARE_APIKEY}