feat(deploy): add k3s deployment foundation and complete offline images

Introduce a self-contained kustomize stack under deploy/k3s covering
namespace, config, placeholder secrets, infra StatefulSets, app
Deployments/Services, migration and minio-init Jobs, and Traefik
Ingress for both tenant and ops hosts. Add Dockerfile.ops-web so the
operations frontend can ship as an nginx image, and extend the offline
package script to build and bundle ops-api, kol-assist-worker, and
ops-web alongside the k3s manifests. Wire the new ops/security knobs
through .env.example and the compose stack.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/k3s/kustomization.yaml

@@ -0,0 +1,56 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: geo-rankly
+
+resources:
+  - namespace.yaml
+  - secrets.yaml
+  - infra-postgres.yaml
+  - infra-monitoring-postgres.yaml
+  - infra-rabbitmq.yaml
+  - infra-redis.yaml
+  - infra-qdrant-minio.yaml
+  - jobs.yaml
+  - apps.yaml
+  - ingress.yaml
+
+labels:
+  - pairs:
+      app.kubernetes.io/part-of: geo-rankly
+
+generatorOptions:
+  disableNameSuffixHash: true
+
+configMapGenerator:
+  - name: geo-rankly-app-config
+    files:
+      - config.yaml=config/config.yaml
+      - prompts.yml=config/prompts.yml
+      - ops-config.yaml=config/ops-config.yaml
+
+images:
+  - name: geo-rankly/migrate
+    newName: geo-rankly/migrate
+    newTag: latest
+  - name: geo-rankly/tenant-api
+    newName: geo-rankly/tenant-api
+    newTag: latest
+  - name: geo-rankly/worker-generate
+    newName: geo-rankly/worker-generate
+    newTag: latest
+  - name: geo-rankly/kol-assist-worker
+    newName: geo-rankly/kol-assist-worker
+    newTag: latest
+  - name: geo-rankly/scheduler
+    newName: geo-rankly/scheduler
+    newTag: latest
+  - name: geo-rankly/ops-api
+    newName: geo-rankly/ops-api
+    newTag: latest
+  - name: geo-rankly/frontend
+    newName: geo-rankly/frontend
+    newTag: latest
+  - name: geo-rankly/ops-web
+    newName: geo-rankly/ops-web
+    newTag: latest