feat(ci): deploy to k3s straight from the pipeline (drop Flux plan)

Push to main = release: after build, a deploy job pins each app image to the
commit SHA (kustomize edit set image), kubectl-applies fleet/apps and waits
for the rollouts. The runner already runs in-cluster, so it reaches the API
server on the in-cluster service IP with a kubeconfig for the new ci-deployer
ServiceAccount (namespace-scoped admin, KUBECONFIG_B64 repo secret).

The drafted Flux sync/image-automation layer is removed — a GitOps controller
plus bot tag-bump commits is more machinery than a single-node cluster needs.
Sortable image tags and $imagepolicy markers go with it.

Also: per-router ACME-safe HTTP->HTTPS redirects for the app ingresses,
platform-api prod config completed (Authentik JWT/JWKS + admin API, Stalwart
via the cni0 gateway IP, OCIS/cold-storage placeholders until those tiers
exist) and the secrets template/README updated to match.

infrastructure/production/fleet/apps/portal.yaml

@@ -21,6 +21,8 @@ spec:
     spec:
       containers:
         - name: portal
+          # CI pins this to the commit SHA at deploy time (kustomize edit set image
+          # in .gitea/workflows/ci.yml); :latest here is the fallback.
           image: git.lastcloud.io/ronnibaslund/dezky/portal:latest
           imagePullPolicy: IfNotPresent
           ports:
@@ -33,6 +35,8 @@ spec:
               value: "3000"
             - name: NUXT_PUBLIC_PORTAL_URL
               value: https://app.dezky.eu
+            - name: NUXT_PUBLIC_BOOKING_URL
+              value: https://booking.dezky.eu
             # Cluster-internal address of platform-api for the nitro proxy.
             - name: PLATFORM_API_INTERNAL_URL
               value: http://platform-api.dezky-apps.svc.cluster.local:3001
@@ -81,7 +85,10 @@ metadata:
   namespace: dezky-apps
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    # Serve on :80 too so the cert-manager ACME HTTP-01 solver can answer on
+    # port 80; the redirect-https middleware bounces all other traffic to HTTPS.
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.middlewares: dezky-apps-redirect-https@kubernetescrd
 spec:
   ingressClassName: traefik
   tls: