feat(deploy): add k3s deployment foundation and complete offline images

Introduce a self-contained kustomize stack under deploy/k3s covering
namespace, config, placeholder secrets, infra StatefulSets, app
Deployments/Services, migration and minio-init Jobs, and Traefik
Ingress for both tenant and ops hosts. Add Dockerfile.ops-web so the
operations frontend can ship as an nginx image, and extend the offline
package script to build and bundle ops-api, kol-assist-worker, and
ops-web alongside the k3s manifests. Wire the new ops/security knobs
through .env.example and the compose stack.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

task_plan.md

@@ -4,7 +4,7 @@
 Continue the desktop AI monitoring implementation by first adding a client-side local scheduler with durable queueing and adaptive execution policy, then adding a reusable hidden Playwright CDP execution layer that attaches to Electron Chromium and reuses existing account partitions.
 
 ## Current Phase
-Phase 36
+Phase 37
 
 ## Phases
 ### Phase 1: Progress Verification
@@ -257,6 +257,18 @@ Phase 36
 - [x] Run targeted backend tests, full `go test ./...`, admin-web typecheck/build, and `git diff --check`
 - **Status:** complete
 
+### Phase 37: k3s Deployment Foundation
+- [x] Inventory compose/runtime services and dependency graph
+- [x] Add kustomize-based k3s manifests for app services, infra stateful services, migration jobs, config, secrets, and ingress
+- [x] Include deployment documentation and image/package notes for online and offline clusters
+- **Status:** complete
+
+### Phase 38: k3s Verification
+- [x] Render manifests locally with kubectl/kustomize
+- [x] Run YAML/static checks available in this workspace
+- [x] Update findings/progress and summarize deployment commands plus required edits
+- **Status:** complete
+
 ## Key Questions
 1. How should the desktop client defer and locally optimize monitor-task execution without violating one-task-per-platform serialism?
 2. What is the smallest durable local cache that allows same-day resume while safely dropping stale next-day monitor tasks?
@@ -307,6 +319,7 @@ Phase 36
 | Materialize daily monitoring tasks with batched array INSERT | The per-brand cap is currently small, but one `INSERT ... SELECT FROM unnest(...) ON CONFLICT DO NOTHING` keeps DB round trips fixed if caps or retry batches grow |
 | Split daily monitoring plan loading into selection and aggregation steps | Primary-client election and platform authorization aggregation have different explainability and testability concerns; two smaller queries are easier to inspect and later move to sqlc |
 | Treat platform-account health as execution state, not authorization state | `health != live` should not suppress daily task planning, dashboard authorization, or detail history; only desktop-client online state gates immediate collection |
+| Start k3s with a self-contained stack that mirrors the existing compose deployment | The repo already has working Docker images and compose topology; k3s should first preserve service names and runtime assumptions before introducing managed cloud replacements |
 
 ## Errors Encountered
 | Error | Attempt | Resolution |
@@ -320,6 +333,7 @@ Phase 36
 | Desktop monitor execution is currently global-serial and lacks durable local queueing | 1 | Replace the ad-hoc in-memory FIFO with a scheduler module that owns persistence, concurrency, and stale-task cleanup |
 | `connectOverCDP()` is not wired yet even though `playwright-core` is installed | 1 | Add a dedicated hidden-browser manager instead of pushing CDP code directly into adapters or the runtime controller |
 | `pnpm --filter @geo/desktop-client typecheck` fails in `electron.vite.config.ts` due to a pre-existing Vite 5/8 plugin type mismatch | 1 | Verified this change with `pnpm --filter @geo/desktop-client build` and `pnpm --filter @geo/desktop-client test`; leave config dependency alignment as a separate fix |
+| `kubectl apply --dry-run=client` still attempted to contact the local kube-apiserver, which is not running at `127.0.0.1:26443` | 1 | Verified with `kubectl kustomize`, parsed the rendered YAML locally, and recorded that live API validation should run on the target k3s cluster |
 
 ## Notes
 - Re-check task_plan.md before major implementation decisions.