feat(deploy): add k3s deployment foundation and complete offline images

Introduce a self-contained kustomize stack under deploy/k3s covering
namespace, config, placeholder secrets, infra StatefulSets, app
Deployments/Services, migration and minio-init Jobs, and Traefik
Ingress for both tenant and ops hosts. Add Dockerfile.ops-web so the
operations frontend can ship as an nginx image, and extend the offline
package script to build and bundle ops-api, kol-assist-worker, and
ops-web alongside the k3s manifests. Wire the new ops/security knobs
through .env.example and the compose stack.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

progress.md

@@ -1,5 +1,37 @@
 # Progress Log
 
+## Session: 2026-04-30
+
+### Phase 37: k3s Deployment Foundation
+- **Status:** complete
+- Actions taken:
+  - Recovered the existing Docker Compose deployment topology and runtime command set.
+  - Added a self-contained `deploy/k3s` kustomize deployment with namespace, config, placeholder secrets, infra StatefulSets, app Deployments/Services, migration/minio-init Jobs, and Traefik Ingress.
+  - Included all server-side runtime services: `tenant-api`, `worker-generate`, `kol-assist-worker`, `scheduler`, `ops-api`, plus `frontend` and `ops-web`.
+  - Added `Dockerfile.ops-web` so the operations frontend can be built as a deployable nginx image.
+  - Updated the offline packaging script to build/save `ops-api`, `kol-assist-worker`, and `ops-web`, and to include the k3s directory in generated deploy packages.
+  - Updated the offline compose override and `.env.example` with the missing ops/security knobs.
+- Files created/modified:
+  - `Dockerfile.ops-web` (created)
+  - `deploy/k3s/` (created)
+  - `deploy/docker-compose.yaml` (updated)
+  - `deploy/scripts/package.sh` (updated)
+  - `deploy/docker-compose.offline.yaml` (updated)
+  - `deploy/.env.example` (updated)
+  - `task_plan.md` / `findings.md` / `progress.md` (updated)
+
+### Phase 38: k3s Verification
+- **Status:** complete
+- Verification:
+  - `kubectl kustomize deploy/k3s` rendered 30 Kubernetes objects.
+  - Local YAML parsing of the rendered manifest passed.
+  - `bash -n deploy/scripts/package.sh && bash -n deploy/scripts/load-and-start.sh` passed.
+  - `git diff --check` passed.
+  - `pnpm --filter ops-web build` passed.
+  - `pnpm --filter admin-web typecheck` passed.
+- Notes:
+  - `kubectl apply --dry-run=client` could not complete locally because the configured kube-apiserver at `127.0.0.1:26443` is not running; run live API validation on the target k3s node.
+
 ## Session: 2026-04-20
 
 ### Phase 20: Tracking Collect-Now Repair