Add K3s dev deployment setup for single-node VPS

Mirrors the prod deploy-k3s/ setup but runs all services in-cluster
on a single node: PostgreSQL (replaces Neon), MinIO S3-compatible
storage (replaces B2), Redis, API, worker, and admin.

Includes fully automated setup scripts (00-init through 04-verify),
server hardening (SSH, fail2ban, ufw), Let's Encrypt TLS via Traefik,
network policies, RBAC, and security contexts matching prod.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy-k3s-dev/secrets/README.md

@@ -0,0 +1,22 @@
+# Secrets Directory
+
+Create these files before running `scripts/02-setup-secrets.sh`:
+
+| File | Purpose |
+|------|---------|
+| `postgres_password.txt` | In-cluster PostgreSQL password |
+| `secret_key.txt` | App signing secret (minimum 32 characters) |
+| `email_host_password.txt` | SMTP password (Fastmail app password) |
+| `fcm_server_key.txt` | Firebase Cloud Messaging server key (optional — Android not yet ready) |
+| `apns_auth_key.p8` | Apple Push Notification private key |
+| `minio_root_password.txt` | MinIO root password (minimum 8 characters) |
+
+Optional (only if `tls.mode: cloudflare` in config.yaml):
+
+| File | Purpose |
+|------|---------|
+| `cloudflare-origin.crt` | Cloudflare origin certificate (PEM) |
+| `cloudflare-origin.key` | Cloudflare origin certificate key (PEM) |
+
+All string config (registry token, domains, etc.) goes in `config.yaml` instead.
+These files are gitignored and should never be committed.