fix(infra): single replica for portal/operator (per-pod OIDC sessions)

nuxt-oidc-auth stores sessions in per-pod memory. With 2 replicas, any
request balanced to the pod that didn't handle the login 401s — in practice
roughly half of all operator API calls failed after sign-in. One replica
until sessions move to shared storage (nitro storage on the dezky-data
Redis), then scale back up. Already scaled live; this pins the manifests so
the next deploy doesn't undo it.

infrastructure/production/fleet/apps/operator.yaml

@@ -13,7 +13,11 @@ metadata:
     app.kubernetes.io/name: operator
     app.kubernetes.io/part-of: dezky
 spec:
-  replicas: 2
+  # Single replica until OIDC sessions move to shared storage: nuxt-oidc-auth
+  # keeps sessions in per-pod memory, so with >1 replica every request that
+  # lands on the pod that did NOT handle the login gets 401. TODO: nitro
+  # session storage on the dezky-data Redis, then scale back up.
+  replicas: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: operator

infrastructure/production/fleet/apps/portal.yaml

@@ -10,7 +10,11 @@ metadata:
     app.kubernetes.io/name: portal
     app.kubernetes.io/part-of: dezky
 spec:
-  replicas: 2
+  # Single replica until OIDC sessions move to shared storage: nuxt-oidc-auth
+  # keeps sessions in per-pod memory, so with >1 replica every request that
+  # lands on the pod that did NOT handle the login gets 401. TODO: nitro
+  # session storage on the dezky-data Redis, then scale back up.
+  replicas: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: portal