Add K3s dev deployment setup for single-node VPS

Mirrors the prod deploy-k3s/ setup but runs all services in-cluster
on a single node: PostgreSQL (replaces Neon), MinIO S3-compatible
storage (replaces B2), Redis, API, worker, and admin.

Includes fully automated setup scripts (00-init through 04-verify),
server hardening (SSH, fail2ban, ufw), Let's Encrypt TLS via Traefik,
network policies, RBAC, and security contexts matching prod.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy-k3s-dev/manifests/rbac.yaml

@@ -0,0 +1,68 @@
+# RBAC — Dedicated service accounts with no K8s API access
+# Each pod gets its own SA with automountServiceAccountToken: false,
+# so a compromised pod cannot query the Kubernetes API.
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: api
+  namespace: honeydue
+  labels:
+    app.kubernetes.io/name: api
+    app.kubernetes.io/part-of: honeydue
+automountServiceAccountToken: false
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: worker
+  namespace: honeydue
+  labels:
+    app.kubernetes.io/name: worker
+    app.kubernetes.io/part-of: honeydue
+automountServiceAccountToken: false
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin
+  namespace: honeydue
+  labels:
+    app.kubernetes.io/name: admin
+    app.kubernetes.io/part-of: honeydue
+automountServiceAccountToken: false
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: redis
+  namespace: honeydue
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/part-of: honeydue
+automountServiceAccountToken: false
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: postgres
+  namespace: honeydue
+  labels:
+    app.kubernetes.io/name: postgres
+    app.kubernetes.io/part-of: honeydue
+automountServiceAccountToken: false
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: minio
+  namespace: honeydue
+  labels:
+    app.kubernetes.io/name: minio
+    app.kubernetes.io/part-of: honeydue
+automountServiceAccountToken: false