feat(sol): add public edge ingress and tls

environments/sol/public-edge/scripts/check-sol-public-edge.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TARGET_HOST="${TARGET_HOST:-mevnode}"
+PUBLIC_IP="${PUBLIC_IP:-149.50.96.162}"
+PUBLIC_HOST="${PUBLIC_HOST:-trade.mpabi.pl}"
+
+ssh_target() {
+  ssh -o StrictHostKeyChecking=no "$TARGET_HOST" "$@"
+}
+
+echo "[1/5] Host listeners"
+ssh_target "sudo ss -ltn '( sport = :80 or sport = :443 )'"
+
+echo
+echo "[2/5] Controller state"
+ssh_target '
+  set -euo pipefail
+  sudo k3s kubectl -n kube-system get ds traefik -o wide
+  sudo k3s kubectl -n cert-manager get deploy -o wide
+'
+
+echo
+echo "[3/5] Issuer and ingress"
+ssh_target '
+  set -euo pipefail
+  sudo k3s kubectl get clusterissuer letsencrypt-prod -o wide
+  sudo k3s kubectl -n trade-r001-canary get ingress trade-frontend-public -o wide
+  sudo k3s kubectl -n trade-r001-canary get certificate,order,challenge 2>/dev/null || true
+'
+
+echo
+echo "[4/5] HTTP health via public IP"
+curl -fsS --resolve "${PUBLIC_HOST}:80:${PUBLIC_IP}" "http://${PUBLIC_HOST}/healthz"
+echo
+
+echo
+echo "[5/5] DNS and TLS state"
+resolved_ip="$(getent ahostsv4 "${PUBLIC_HOST}" | awk 'NR==1 {print $1}')"
+echo "resolved_ip=${resolved_ip:-<none>}"
+if [ "${resolved_ip:-}" = "${PUBLIC_IP}" ]; then
+  curl -fsS --resolve "${PUBLIC_HOST}:443:${PUBLIC_IP}" "https://${PUBLIC_HOST}/healthz"
+  echo
+else
+  echo "TLS check skipped until ${PUBLIC_HOST} resolves to ${PUBLIC_IP}"
+fi
+
+echo
+echo "Public edge check completed for ${PUBLIC_HOST}"