k8s admin: expose thanos through an ingress endpoint with a real certificate

and reorder the prometheus configuration to make terraform happy

Related to infra/sysadm-environment#4385 and infra/sysadm-environment#4604

/cc @teams/sysadmin