feat: k3s migration — k8s manifests, Traefik Ingress, CI deploy change

- Remove drizzle stage from Dockerfile (migration moved to k8s Job)
- Add k8s manifests: deployments, services, ingress, HPA, PDB, RBAC
- Replace Swarm deploy in CI with kubectl create job + kubectl set image
- Add k8s trusted origin to better-auth config
- Document all decisions in k8s/README.md

Dockerfile

@@ -21,21 +21,6 @@ COPY patches ./patches
 # Install into cache, then persist into real node_modules
 RUN --mount=type=cache,target=/root/.bun bun install --frozen-lockfile
 
-### Stage N: drizzle ###
-FROM oven/bun:canary-alpine as drizzle
-
-# Isolation
-RUN adduser -Du 1001 container
-USER container
-WORKDIR /home/container
-COPY --from=deps /home/container/node_modules ./node_modules
-COPY --from=deps /home/container/package*.json ./
-COPY --from=deps /home/container/bun.lock ./
-COPY --chown=1001 ./drizzle.config.ts ./.env ./
-COPY --chown=1001 ./lib/db ./lib/db
-
-RUN bun dr push
-
 ### Stage 2: builder ###
 FROM oven/bun:canary-alpine AS builder