feat(deploy): add k3s deployment foundation and complete offline images

Introduce a self-contained kustomize stack under deploy/k3s covering
namespace, config, placeholder secrets, infra StatefulSets, app
Deployments/Services, migration and minio-init Jobs, and Traefik
Ingress for both tenant and ops hosts. Add Dockerfile.ops-web so the
operations frontend can ship as an nginx image, and extend the offline
package script to build and bundle ops-api, kol-assist-worker, and
ops-web alongside the k3s manifests. Wire the new ops/security knobs
through .env.example and the compose stack.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/docker-compose.offline.yaml

@@ -28,6 +28,11 @@ services:
     pull_policy: never
     build: !reset null
 
+  ops-api:
+    image: geo-rankly/ops-api:${IMAGE_TAG:-latest}
+    pull_policy: never
+    build: !reset null
+
   frontend:
     image: geo-rankly/frontend:${IMAGE_TAG:-latest}
     pull_policy: never