ci: build, push and deploy to personal cluster on push to master

- Gitea Actions workflow: build, push sha-tagged image, apply kustomize, wait for rollout with auto-rollback
- Deploy to personal-site namespace, served at jesseinit.dev with TLS
- Run container as non-root and bind to 0.0.0.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

k8s/deployment.yaml

@@ -6,6 +6,12 @@ metadata:
     app: jesseinit-portfolio
 spec:
   replicas: 2
+  revisionHistoryLimit: 5
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
   selector:
     matchLabels:
       app: jesseinit-portfolio
@@ -24,12 +30,20 @@ spec:
         env:
         - name: NODE_ENV
           value: "production"
+        - name: HOSTNAME
+          value: "0.0.0.0"
+        - name: PORT
+          value: "3000"
         - name: NEXT_TELEMETRY_DISABLED
           value: "1"
         envFrom:
         - configMapRef:
             name: jesseinit-portfolio-config
             optional: true
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 1000
+          allowPrivilegeEscalation: false
         resources:
           requests:
             memory: "128Mi"