feat(deploy): k8s manifests for microk8s (vncmail.sandbox.vnc.de)

Bulwark is stateful (local /app/data) — Vercel serverless (read-only fs)
crashes it. Deploy as a container with 4 persistent volumes on microk8s,
alongside bulwark.sandbox.vnc.de. Adds deploy/k8s/ (namespace, pvc, deployment,
service, ingress, secret template, runbook) + rewrites setup doc off Vercel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vnc/VNC-CHANGES.md

@@ -23,6 +23,14 @@ that merging new upstream releases stays a triage exercise, not an archaeology d
 | 2026-08-03 | `vnc/` (new) | Added VNC customization dir + this log | Fork bootstrap |
 | 2026-08-03 | `VNCMAIL-SETUP.md` (new) | Vercel deploy runbook | Deploy on Vercel as project "VNCmail+" |
 
-_Note: a microfrontends integration (next.config wrap + `@vercel/microfrontends`) was added and then **reverted** on 2026-08-03 — VNCmail+ is a standalone project, grouped organizationally via a separate Vercel team, not a microfrontends group._
+| 2026-08-03 | `deploy/k8s/` (new) | k8s manifests + runbook for microk8s deploy | Bulwark is stateful → runs as a container w/ persistent volumes, not Vercel serverless |
+| 2026-08-03 | `.gitignore` | ignore `deploy/k8s/secret.yaml` | keep the real env secret out of git |
+
+_Note: Vercel was tried and **abandoned** on 2026-08-03. Bulwark writes to a local
+data dir (`/app/data/*`); Vercel serverless has a read-only filesystem → crash
+(`ENOENT /var/task/data`). VNCmail+ now deploys as a Docker image
+(`ghcr.io/brvncde-dotcom/vncmail-plus-*`) on Kubernetes (microk8s) at
+`vncmail.sandbox.vnc.de`, with 4 persistent volumes — see `deploy/k8s/`. A
+microfrontends integration was also added and reverted the same day._
 
 _(append new rows as you diverge)_