- Move ingress.yaml to manifests/ (public + protected ingress) - Keep ingress disabled in helm-values.yaml due to complex routing