feat(deploy): k8s manifests for microk8s (vncmail.sandbox.vnc.de)

Bulwark is stateful (local /app/data) — Vercel serverless (read-only fs)
crashes it. Deploy as a container with 4 persistent volumes on microk8s,
alongside bulwark.sandbox.vnc.de. Adds deploy/k8s/ (namespace, pvc, deployment,
service, ingress, secret template, runbook) + rewrites setup doc off Vercel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/k8s/ingress.yaml

@@ -0,0 +1,34 @@
+# Exposes VNCmail+ at vncmail.sandbox.vnc.de, alongside bulwark.sandbox.vnc.de.
+# MATCH YOUR CLUSTER — inspect the existing Bulwark ingress and copy its
+# ingressClassName + TLS/cert-manager annotations:
+#   kubectl get ingress -A | grep bulwark
+#   kubectl get ingress <bulwark-ingress> -n <ns> -o yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vncmail-plus
+  namespace: vncmail
+  annotations:
+    # cert-manager issuer — set to whatever bulwark.sandbox.vnc.de uses.
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Mail attachments can be large; raise the nginx body limit.
+    nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+spec:
+  # microk8s ingress addon class is usually "public" (nginx). Confirm with
+  # `kubectl get ingressclass` and match bulwark's.
+  ingressClassName: public
+  tls:
+    - hosts:
+        - vncmail.sandbox.vnc.de
+      secretName: vncmail-plus-tls
+  rules:
+    - host: vncmail.sandbox.vnc.de
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vncmail-plus
+                port:
+                  number: 80