Add k3s deployment scaffolding for dist/ on Vultr

Ships the static landing page to the existing k3s cluster at
65.20.110.165, served at www.apexturf.es (apexturf.es redirects to
it), using a self-hosted Gitea instance as the container registry.

- deploy/Dockerfile + nginx.conf: nginx:alpine image serving dist/
  (SPA-safe fallback, gzip, cache headers). Build-tested locally
  against the real dist/ output.
- deploy/k8s/apex-turf/: Namespace, Deployment, Service, and two
  Ingresses (www.apexturf.es + a Traefik Middleware redirect from
  the bare domain).
- deploy/k8s/cert-manager/: Let's Encrypt ClusterIssuers (prod +
  staging) for HTTP-01 via the cluster's bundled Traefik.
- deploy/k8s/gitea/: Helm values for a lightweight, SQLite-backed
  Gitea at git.apexturf.es with its container registry enabled.
- docs/DEPLOYMENT.md: full phased runbook with exact commands,
  troubleshooting, and a redeploy cheat sheet.
- docs/README.md: point at the new deploy/ tree and runbook.

Nothing here touches the remote cluster — these are local manifests
and docs for the user to apply themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/nginx.conf

@@ -0,0 +1,30 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Gzip static text assets
+    gzip on;
+    gzip_vary on;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+
+    # Long cache for fingerprint-free static assets; short cache for HTML so
+    # deploys show up without needing a hard-refresh.
+    location ~* \.(?:css|js|png|jpg|jpeg|svg|ico|woff2?)$ {
+        expires 7d;
+        add_header Cache-Control "public, max-age=604800, immutable";
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-cache";
+    }
+
+    # Basic hardening headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    error_page 404 /index.html;
+}