Repo-standard flexible ingress (required clusterIssuer instead of the hardcoded letsencrypt-issuer, domain moved from config.domain to ingress.domain, className value, annotations merge, standard TLS secret name), secrets.<name>SecretRef structure, core secret renamed to the standard -secret name, additive tpl-rendered env block, documented PVC naming exception. Major bump 4.1.2+up4.7.0 -> 5.0.0+up4.7.0.