feat(infra): k3s foundation — cert-manager, Longhorn config, in-cluster data tier

Adds the production cluster foundation (authored + applied live on node1):
- cert-manager via the k3s HelmChart controller + letsencrypt staging/prod
  ClusterIssuers (HTTP-01 / Traefik).
- Longhorn config for single-node (values: replica=1, default StorageClass,
  Retain) + backup-to-Hetzner-Object-Storage credential template.
- In-cluster data tier (dezky-data): Postgres 16 (with Authentik+OCIS DB init),
  MongoDB 7, Redis 7 as StatefulSets on Longhorn, + secret template.
- bootstrap.sh: install open-iscsi/nfs-common + enable iscsid (Longhorn prereq).
- RUNBOOK.md: full reproducible node1 build order.

Real secrets are generated on-box and kept in Bitwarden — never in git.

.gitignore

@@ -37,6 +37,9 @@ data/
 # But keep app-level data/ dirs — operator carries mock fixtures there.
 !apps/*/data/
 !apps/*/data/**
+# ...and the production fleet data-tier manifests (k8s YAML, not volume data).
+!infrastructure/production/fleet/data/
+!infrastructure/production/fleet/data/**
 
 # Coverage
 coverage/