feat: add Kubernetes deployment path

[franciscojavierarceo]

Summary

• add a Kustomize-compatible Kubernetes base with replicated gateway pods, probes, resource limits, graceful termination, disruption protection, default-deny ingress, and opt-in ingress-controller access
• make /ready check PostgreSQL and the authenticated inference health endpoint concurrently with bounded timeouts, while honoring SKIP_LLM_READY_CHECK
• document image overlays, secrets, migrations, authenticated SSE/WebSocket ingress, credential rotation, rollout verification, and replica placement
• add Rust tests that parse the manifests and cover database failure, authenticated upstream health, and skipped upstream readiness

This is the unclaimed Kubernetes deployment slice of #102. Production PostgreSQL use should land with #142; this PR does not duplicate that PR's pool and schema work.

Closes #108.
Refs #102.

Test Plan

• cargo fmt -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test
• SKIP=no-commit-to-branch uvx pre-commit run --all-files
• uv run --with-requirements docs/requirements.txt mkdocs build
• read-only Claude review
• gstack specialist, red-team, adversarial, and structured reviews

mkdocs build --strict still stops on the pre-existing broken ../../ROADMAP.md link in docs/design/claude-code-integration.md; the non-strict documentation build passes.