feat(infra): k3s foundation — cert-manager, Longhorn config, in-cluster data tier

Adds the production cluster foundation (authored + applied live on node1):
- cert-manager via the k3s HelmChart controller + letsencrypt staging/prod
  ClusterIssuers (HTTP-01 / Traefik).
- Longhorn config for single-node (values: replica=1, default StorageClass,
  Retain) + backup-to-Hetzner-Object-Storage credential template.
- In-cluster data tier (dezky-data): Postgres 16 (with Authentik+OCIS DB init),
  MongoDB 7, Redis 7 as StatefulSets on Longhorn, + secret template.
- bootstrap.sh: install open-iscsi/nfs-common + enable iscsid (Longhorn prereq).
- RUNBOOK.md: full reproducible node1 build order.

Real secrets are generated on-box and kept in Bitwarden — never in git.

infrastructure/production/host/bootstrap.sh

@@ -63,8 +63,12 @@ apt-get upgrade -y -qq
 apt-get install -y -qq \
     nftables fail2ban unattended-upgrades apt-listchanges \
     curl ca-certificates gnupg htop tmux vim chrony \
+    open-iscsi nfs-common \
     >/dev/null
-ok "Base packages installed."
+# Longhorn requires a running iscsid on every node; nfs-common is needed for
+# RWX volumes / NFS backup targets.
+systemctl enable --now iscsid >/dev/null 2>&1 || true
+ok "Base packages installed (incl. Longhorn prereqs: open-iscsi, nfs-common)."
 
 # ── Step 2: hostname + timezone + time sync ────────────────────────────────
 info "Step 2: Hostname, timezone (UTC), time sync..."