ci: build, push and deploy to personal cluster on push to master

- Gitea Actions workflow: build, push sha-tagged image, apply kustomize, wait for rollout with auto-rollback
- Deploy to personal-site namespace, served at jesseinit.dev with TLS
- Run container as non-root and bind to 0.0.0.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

k8s/kustomization.yaml

@@ -1,18 +1,22 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-namespace: default
+namespace: personal-site
 
 resources:
+  - namespace.yaml
   - configmap.yaml
   - deployment.yaml
   - service.yaml
   - ingress.yaml
 
-commonLabels:
-  app: jesseinit-portfolio
+labels:
+  - pairs:
+      app.kubernetes.io/name: personal-site
+      app.kubernetes.io/managed-by: kustomize
 
+# CI rewrites newTag to sha-<commit> before applying.
 images:
   - name: jesseinit-portfolio
-    newName: jesseinit-portfolio
+    newName: tea.jesseinit.dev/jesseinit/personal-site
     newTag: latest