feat(deploy): k8s manifests for microk8s (vncmail.sandbox.vnc.de)

Bulwark is stateful (local /app/data) — Vercel serverless (read-only fs)
crashes it. Deploy as a container with 4 persistent volumes on microk8s,
alongside bulwark.sandbox.vnc.de. Adds deploy/k8s/ (namespace, pvc, deployment,
service, ingress, secret template, runbook) + rewrites setup doc off Vercel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/k8s/secret.example.yaml

@@ -0,0 +1,19 @@
+# Copy to secret.yaml, fill in real values, and apply. DO NOT commit secret.yaml
+# (it is gitignored). Generate SESSION_SECRET with:  openssl rand -base64 32
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vncmail-env
+  namespace: vncmail
+type: Opaque
+stringData:
+  # Core — connect to Stalwart over JMAP
+  JMAP_SERVER_URL: "https://stalwart.sandbox.vnc.de"
+  SESSION_SECRET: "REPLACE_ME__openssl_rand_base64_32"
+  # Branding
+  APP_NAME: "VNCmail+"
+  APP_SHORT_NAME: "VNCmail+"
+  LOGIN_COMPANY_NAME: "VNC"
+  # Housekeeping
+  BULWARK_UPDATE_CHECK: "off"
+  # Data dirs default to /app/data/* (mounted to the PVCs) — no need to set them.