Add k3s deployment scaffolding for dist/ on Vultr

Ships the static landing page to the existing k3s cluster at
65.20.110.165, served at www.apexturf.es (apexturf.es redirects to
it), using a self-hosted Gitea instance as the container registry.

- deploy/Dockerfile + nginx.conf: nginx:alpine image serving dist/
  (SPA-safe fallback, gzip, cache headers). Build-tested locally
  against the real dist/ output.
- deploy/k8s/apex-turf/: Namespace, Deployment, Service, and two
  Ingresses (www.apexturf.es + a Traefik Middleware redirect from
  the bare domain).
- deploy/k8s/cert-manager/: Let's Encrypt ClusterIssuers (prod +
  staging) for HTTP-01 via the cluster's bundled Traefik.
- deploy/k8s/gitea/: Helm values for a lightweight, SQLite-backed
  Gitea at git.apexturf.es with its container registry enabled.
- docs/DEPLOYMENT.md: full phased runbook with exact commands,
  troubleshooting, and a redeploy cheat sheet.
- docs/README.md: point at the new deploy/ tree and runbook.

Nothing here touches the remote cluster — these are local manifests
and docs for the user to apply themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/k8s/cert-manager/cluster-issuer.yaml

@@ -0,0 +1,39 @@
+# Requires cert-manager to already be installed (see docs/DEPLOYMENT.md Phase 3).
+# k3s ships Traefik as its ingress controller by default, which is what the
+# http01 solver below targets. If you disabled Traefik at k3s install time,
+# swap `class: traefik` for whatever ingress controller you're running.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    # CHANGE ME if you'd rather Let's Encrypt expiry/abuse notices go elsewhere.
+    email: hello@albertabril.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+---
+# Optional but recommended while testing: Let's Encrypt's staging environment
+# has much higher rate limits and issues untrusted (but structurally identical)
+# certs, so you can validate the whole chain without risking the production
+# rate limit (5 certs/domain/week). Point an Ingress at this issuer first,
+# confirm it works, then switch to letsencrypt-prod.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: hello@albertabril.com
+    privateKeySecretRef:
+      name: letsencrypt-staging-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik