Add k3s deployment scaffolding for dist/ on Vultr

Ships the static landing page to the existing k3s cluster at
65.20.110.165, served at www.apexturf.es (apexturf.es redirects to
it), using a self-hosted Gitea instance as the container registry.

- deploy/Dockerfile + nginx.conf: nginx:alpine image serving dist/
  (SPA-safe fallback, gzip, cache headers). Build-tested locally
  against the real dist/ output.
- deploy/k8s/apex-turf/: Namespace, Deployment, Service, and two
  Ingresses (www.apexturf.es + a Traefik Middleware redirect from
  the bare domain).
- deploy/k8s/cert-manager/: Let's Encrypt ClusterIssuers (prod +
  staging) for HTTP-01 via the cluster's bundled Traefik.
- deploy/k8s/gitea/: Helm values for a lightweight, SQLite-backed
  Gitea at git.apexturf.es with its container registry enabled.
- docs/DEPLOYMENT.md: full phased runbook with exact commands,
  troubleshooting, and a redeploy cheat sheet.
- docs/README.md: point at the new deploy/ tree and runbook.

Nothing here touches the remote cluster — these are local manifests
and docs for the user to apply themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/k8s/gitea/values.yaml

@@ -0,0 +1,85 @@
+# Helm values for the official Gitea chart (https://gitea.com/gitea/helm-chart).
+# Tuned for a single small Vultr node: SQLite instead of a bundled Postgres,
+# no Redis/cache dependency, modest resource requests.
+#
+# Install with (see docs/DEPLOYMENT.md Phase 4):
+#   helm repo add gitea-charts https://dl.gitea.com/charts/
+#   helm upgrade --install gitea gitea-charts/gitea \
+#     --namespace gitea --create-namespace \
+#     -f deploy/k8s/gitea/values.yaml
+
+replicaCount: 1
+
+# SQLite keeps this to a single pod with no extra database dependency.
+# Fine for a personal/small-team instance; migrate to Postgres later if this
+# ever needs to scale beyond one node.
+postgresql:
+  enabled: false
+postgresql-ha:
+  enabled: false
+redis-cluster:
+  enabled: false
+
+persistence:
+  enabled: true
+  size: 10Gi
+  # CHANGE ME if your Vultr node's disk is smaller than ~15-20Gi free, or if
+  # you know you'll host many/large repos and images.
+  # storageClassName defaults to k3s's built-in "local-path" provisioner.
+
+gitea:
+  admin:
+    # Change this password after first login; it's only the seed value used
+    # on first boot. Better yet, override it at install time with
+    # `--set gitea.admin.password=...` instead of committing a real one here.
+    existingSecret: ""
+    username: apexadmin
+    password: "changeme-before-first-boot"
+    email: "hello@albertabril.com"
+
+  config:
+    server:
+      DOMAIN: git.apexturf.es
+      ROOT_URL: https://git.apexturf.es/
+      HTTP_PORT: 3000
+    database:
+      DB_TYPE: sqlite3
+    session:
+      PROVIDER: memory
+    cache:
+      ADAPTER: memory
+    queue:
+      TYPE: level
+    # Package registry (incl. the Docker/OCI container registry) is enabled
+    # by default on modern Gitea, but set explicitly so this doesn't silently
+    # depend on the chart's/Gitea's current default.
+    packages:
+      ENABLED: true
+
+service:
+  http:
+    type: ClusterIP
+    port: 3000
+
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+  hosts:
+    - host: git.apexturf.es
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: gitea-tls
+      hosts:
+        - git.apexturf.es
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi