ci: build, push and deploy to personal cluster on push to master

- Gitea Actions workflow: build, push sha-tagged image, apply kustomize, wait for rollout with auto-rollback
- Deploy to personal-site namespace, served at jesseinit.dev with TLS
- Run container as non-root and bind to 0.0.0.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

k8s/ingress.yaml

@@ -5,24 +5,25 @@ metadata:
   labels:
     app: jesseinit-portfolio
   annotations:
-    # Uncomment and configure based on your ingress controller
-    # nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    # cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    # Redirect www.jesseinit.dev -> jesseinit.dev
+    nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
 spec:
-  ingressClassName: nginx  # Change to your ingress class (nginx, traefik, etc.)
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - jesseinit.dev
+        - www.jesseinit.dev
+      secretName: personal-site-tls
   rules:
-  - host: jesseinit.com  # Replace with your domain
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: jesseinit-portfolio
-            port:
-              number: 80
-  # Uncomment for TLS/HTTPS support
-  # tls:
-  # - hosts:
-  #   - jesseinit.com
-  #   secretName: jesseinit-portfolio-tls
+    - host: jesseinit.dev
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: jesseinit-portfolio
+                port:
+                  number: 80