feat(deploy): k8s manifests for microk8s (vncmail.sandbox.vnc.de)

Bulwark is stateful (local /app/data) — Vercel serverless (read-only fs)
crashes it. Deploy as a container with 4 persistent volumes on microk8s,
alongside bulwark.sandbox.vnc.de. Adds deploy/k8s/ (namespace, pvc, deployment,
service, ingress, secret template, runbook) + rewrites setup doc off Vercel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -50,3 +50,6 @@ next-env.d.ts
 
 # Sibling repos
 /repos/
+
+# k8s deploy secret (create from deploy/k8s/secret.example.yaml)
+/deploy/k8s/secret.yaml