feat(deploy): add k3s deployment foundation and complete offline images

Introduce a self-contained kustomize stack under deploy/k3s covering
namespace, config, placeholder secrets, infra StatefulSets, app
Deployments/Services, migration and minio-init Jobs, and Traefik
Ingress for both tenant and ops hosts. Add Dockerfile.ops-web so the
operations frontend can ship as an nginx image, and extend the offline
package script to build and bundle ops-api, kol-assist-worker, and
ops-web alongside the k3s manifests. Wire the new ops/security knobs
through .env.example and the compose stack.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/.env.example

@@ -18,6 +18,9 @@ SILICONFLOW_API_KEY=your-siliconflow-api-key-here
 # JWT signing secret — use a strong random string in production
 # Generate: openssl rand -hex 32
 JWT_SECRET=change-me-in-production
+OPS_JWT_SECRET=change-me-in-production
+OPS_DEFAULT_ADMIN_PASSWORD=change-me-before-first-start
+SCHEDULER_INTERNAL_METRICS_TOKEN=change-me-scheduler-metrics-token
 
 # ─── Optional: MinIO credentials ─────────────────────────────────────────────
 MINIO_ROOT_USER=minioadmin
@@ -26,5 +29,6 @@ MINIO_ROOT_PASSWORD=minioadmin
 # ─── Optional: Exposed ports ─────────────────────────────────────────────────
 FRONTEND_PORT=80
 API_PORT=8080
+OPS_API_PORT=8090
 RABBITMQ_MGMT_PORT=15672
 MINIO_CONSOLE_PORT=9001