Add k3s deployment scaffolding for dist/ on Vultr

Ships the static landing page to the existing k3s cluster at
65.20.110.165, served at www.apexturf.es (apexturf.es redirects to
it), using a self-hosted Gitea instance as the container registry.

- deploy/Dockerfile + nginx.conf: nginx:alpine image serving dist/
  (SPA-safe fallback, gzip, cache headers). Build-tested locally
  against the real dist/ output.
- deploy/k8s/apex-turf/: Namespace, Deployment, Service, and two
  Ingresses (www.apexturf.es + a Traefik Middleware redirect from
  the bare domain).
- deploy/k8s/cert-manager/: Let's Encrypt ClusterIssuers (prod +
  staging) for HTTP-01 via the cluster's bundled Traefik.
- deploy/k8s/gitea/: Helm values for a lightweight, SQLite-backed
  Gitea at git.apexturf.es with its container registry enabled.
- docs/DEPLOYMENT.md: full phased runbook with exact commands,
  troubleshooting, and a redeploy cheat sheet.
- docs/README.md: point at the new deploy/ tree and runbook.

Nothing here touches the remote cluster — these are local manifests
and docs for the user to apply themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/README.md

@@ -19,7 +19,15 @@ dist/
 docs/
 ├── README.md                 # this file
 ├── Changelog.md
-└── CONTENT-SPECS.md          # all 7 pdfs/ specs archived as markdown (4 used, 2 not-yet-built, 1 duplicate)
+├── CONTENT-SPECS.md          # all 7 pdfs/ specs archived as markdown (4 used, 2 not-yet-built, 1 duplicate)
+└── DEPLOYMENT.md              # runbook: ship dist/ to the k3s cluster on Vultr
+deploy/
+├── Dockerfile                 # nginx:alpine serving dist/ (build context = repo root)
+├── nginx.conf
+└── k8s/
+    ├── apex-turf/              # Namespace, Deployment, Service, Ingress (+www redirect) for the site
+    ├── cert-manager/            # Let's Encrypt ClusterIssuers
+    └── gitea/                   # Helm values for the self-hosted Gitea registry
 ```
 
 To preview locally: open `dist/index.html` directly in a browser, or serve the folder