- Remove drizzle stage from Dockerfile (migration moved to k8s Job)
- Add k8s manifests: deployments, services, ingress, HPA, PDB, RBAC
- Replace Swarm deploy in CI with kubectl create job + kubectl set image
- Add k8s trusted origin to better-auth config
- Document all decisions in k8s/README.md