add: metrics-server for kubectl top / HPA

Metrics API (metrics.k8s.io) wasn't registered, so kubectl top failed with
'Metrics API not available'. kube-state-metrics from kube-prometheus-stack
doesn't provide it. Uses --kubelet-insecure-tls since kubeadm kubelets serve
self-signed certs (no serverTLSBootstrap), and scrapes kubelets by
InternalIP.

README.md

@@ -15,6 +15,7 @@ Bootstrap order (sync waves):
   Wave 1 → metallb-config   (IPAddressPool + L2Advertisement)
   Wave 2 → envoy-gateway    (HTTP gateway controller)
   Wave 2 → nfs-provisioner  (dynamic PVC provisioner from xpen NAS)
+  Wave 2 → metrics-server   (Metrics API for `kubectl top` / HPA, kube-system)
   Wave 3 → envoy-gateway-config (GatewayClass + EnvoyProxy + Gateway)
 
 External access: