feat(deploy): add k3s deployment foundation and complete offline images

Introduce a self-contained kustomize stack under deploy/k3s covering
namespace, config, placeholder secrets, infra StatefulSets, app
Deployments/Services, migration and minio-init Jobs, and Traefik
Ingress for both tenant and ops hosts. Add Dockerfile.ops-web so the
operations frontend can ship as an nginx image, and extend the offline
package script to build and bundle ops-api, kol-assist-worker, and
ops-web alongside the k3s manifests. Wire the new ops/security knobs
through .env.example and the compose stack.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/k3s/config/ops-config.yaml

@@ -0,0 +1,51 @@
+server:
+  port: 8090
+  mode: release
+
+database:
+  host: postgres
+  port: 5432
+  user: geo
+  password: geo_dev
+  dbname: geo
+  sslmode: disable
+  max_open_conns: 10
+  max_idle_conns: 2
+
+monitoring_database:
+  host: monitoring-postgres
+  port: 5432
+  user: geo
+  password: geo_dev
+  dbname: geo_monitoring
+  sslmode: disable
+  max_open_conns: 10
+  max_idle_conns: 2
+
+redis:
+  addr: redis:6379
+  db: 0
+
+cache:
+  driver: redis
+
+log:
+  level: info
+  format: json
+
+jwt:
+  secret: ""
+  access_ttl: 8h
+
+default_admin:
+  username: admin
+  display_name: system-admin
+  email: ""
+  password: ""
+
+admin_users:
+  default_plan_code: free
+
+ip_region:
+  v4_xdb_path: ""
+  v6_xdb_path: ""