feat(ci): deploy to k3s straight from the pipeline (drop Flux plan)

Push to main = release: after build, a deploy job pins each app image to the
commit SHA (kustomize edit set image), kubectl-applies fleet/apps and waits
for the rollouts. The runner already runs in-cluster, so it reaches the API
server on the in-cluster service IP with a kubeconfig for the new ci-deployer
ServiceAccount (namespace-scoped admin, KUBECONFIG_B64 repo secret).

The drafted Flux sync/image-automation layer is removed — a GitOps controller
plus bot tag-bump commits is more machinery than a single-node cluster needs.
Sortable image tags and $imagepolicy markers go with it.

Also: per-router ACME-safe HTTP->HTTPS redirects for the app ingresses,
platform-api prod config completed (Authentik JWT/JWKS + admin API, Stalwart
via the cni0 gateway IP, OCIS/cold-storage placeholders until those tiers
exist) and the secrets template/README updated to match.

.gitea/workflows/ci.yml

@@ -19,6 +19,7 @@ jobs:
           - { name: portal, dir: apps/portal }
           - { name: booking, dir: apps/booking }
           - { name: website, dir: apps/website }
+          - { name: operator, dir: apps/operator }
     defaults:
       run:
         working-directory: ${{ matrix.target.dir }}
@@ -65,6 +66,7 @@ jobs:
           - { name: portal, dir: apps/portal }
           - { name: booking, dir: apps/booking }
           - { name: platform-api, dir: services/platform-api }
+          - { name: operator, dir: apps/operator }
     steps:
       - uses: actions/checkout@v4
       - name: Registry login
@@ -72,6 +74,47 @@ jobs:
       - name: Build + push
         run: |
           IMG=git.lastcloud.io/ronnibaslund/dezky/${{ matrix.app.name }}
-          docker build -t "$IMG:latest" -t "$IMG:${{ github.sha }}" "${{ matrix.app.dir }}"
+          # The commit SHA tag is what the deploy job pins the cluster to;
+          # ':latest' is kept for humans / manual pulls only.
+          docker build \
+            -t "$IMG:latest" \
+            -t "$IMG:${{ github.sha }}" \
+            "${{ matrix.app.dir }}"
           docker push "$IMG:latest"
           docker push "$IMG:${{ github.sha }}"
+
+  # Deploy the freshly built images to the k3s cluster the runner already runs
+  # in. No GitOps controller in between: kustomize pins each Deployment to this
+  # commit's SHA tag and kubectl applies the manifests, so "push to main" IS
+  # the release. Auth is the KUBECONFIG_B64 repo secret — a kubeconfig for the
+  # ci-deployer ServiceAccount (see infrastructure/production/fleet/ci/
+  # ci-deployer.yaml), reaching the API server on the in-cluster service IP.
+  deploy:
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install kubectl + kustomize
+        run: |
+          curl -fsSLo /usr/local/bin/kubectl https://dl.k8s.io/release/v1.33.4/bin/linux/amd64/kubectl
+          chmod +x /usr/local/bin/kubectl
+          curl -fsSL https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.6.0/kustomize_v5.6.0_linux_amd64.tar.gz \
+            | tar -xz -C /usr/local/bin kustomize
+
+      - name: Deploy to k3s
+        env:
+          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
+        run: |
+          export KUBECONFIG=/tmp/kubeconfig
+          echo "$KUBECONFIG_B64" | base64 -d > "$KUBECONFIG"
+          cd infrastructure/production/fleet/apps
+          for app in platform-api portal booking operator; do
+            kustomize edit set image \
+              "git.lastcloud.io/ronnibaslund/dezky/$app=git.lastcloud.io/ronnibaslund/dezky/$app:${{ github.sha }}"
+          done
+          kubectl apply -k .
+          for app in platform-api portal booking operator; do
+            kubectl -n dezky-apps rollout status "deploy/$app" --timeout=180s
+          done