feat: add K3S single-node deployment scripts for self-hosted EnvSync

[jmac052002]

What this PR adds

Three platform-agnostic bash scripts for deploying and maintaining
EnvSync on a self-hosted K3S single-node cluster.

scripts/deploy/init.sh

• Prompts for root domain at runtime and generates all subdomains
• Installs K3S on any fresh Ubuntu/Debian server
• Generates Traefik IngressRoute manifests dynamically using the domain
• Configures: api.x.y · auth.x.y · s3.x.y · app.x.y
• Waits for pods to be healthy then runs bun cli init

scripts/deploy/backup.sh

• Runs pg_dump inside the postgres pod via kubectl exec
• Saves to /var/backups/envsync/$DATE with timestamp folder
• Prunes backups older than 7 days automatically

scripts/deploy/upgrade.sh

• Accepts a new image tag as an argument (e.g. v0.4.2)
• Runs a backup automatically before any changes
• Performs rolling update via kubectl set image
• Auto rolls back if the rollout fails

Notes

• Zero cloud provider dependencies -works on Hetzner, AWS, DigitalOcean,
  or bare metal
• Assumes wildcard DNS *.domain already points to the server IP

[BRAVO68WEB]

Make sure to test this once, also make sure to run other containers too

[BRAVO68WEB]

This script only creates the reverse proxy, It also needs to create pods for older container like postgres, clickstack, zetadel, etc

[jmac052002]

Thanks for the review you're right, the deployment and service manifests for postgres, Zitadel, Redis, RustFS, and the app containers are missing. I'll add those to init.sh now.

[jmac052002]

Updated added Deployment and Service manifests for all pods: postgres, redis, rustfs, zitadel, zitadel-db, openfga, openfga-db, minikms, minikms-db, envsync-api, and envsync-web. Also added a secrets manifest for MINIKMS_ROOT_KEY. Tested locally with k3d all infrastructure pods come up healthy, openfga-migrate completes successfully. envsync-api and envsync-web require the production .env values and a publicly accessible GHCR image to fully start.