feat(auth): scaffold Ory Kratos identity service — phase 1 (infrastructure)

First phase of replacing the hand-rolled auth (internal/services/auth_service.go
et al.) with Ory Kratos. This commit is infrastructure only — Kratos will run
but nothing consumes it yet; the Go API still does its own auth until phase 2.

Adds deploy-k3s/manifests/kratos/:
- configmap.yaml  — kratos.yml, identity schema, Google/Apple OIDC claim
                     mappers (no secrets in the ConfigMap)
- migrate-job.yaml — `kratos migrate sql`, run before the Deployment
- kratos.yaml     — Deployment (x2), Service, NetworkPolicies
- ingress.yaml    — auth.myhoneydue.com -> Kratos public API :4433
- README.md       — operator prerequisites + deploy runbook

Wiring:
- 02-setup-secrets.sh creates kratos-secrets, gated on a config.yaml `kratos:`
  block (DSN, cookie/cipher, SMTP URI, OIDC client secret, Apple key).
- 03-deploy.sh applies the Kratos manifests + runs the migrate Job, gated on
  the kratos-secrets Secret existing.

Both gates mean the existing stack deploys completely unaffected until the
operator completes the prerequisites (Neon `kratos` DB, auth.myhoneydue.com
DNS, Apple/Google OAuth apps, Kratos image version). Pre-production, so no
user-data migration — see manifests/kratos/README.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy-k3s/manifests/kratos/ingress.yaml

@@ -0,0 +1,38 @@
+# Public ingress for Ory Kratos — auth.myhoneydue.com → Kratos public API :4433.
+#
+# Chains the same edge middlewares as the honeyDue API ingress: cloudflare-only
+# (reject non-Cloudflare source IPs), security-headers, and the general
+# rate-limit. Kratos's self-service flows are multi-request, so the strict
+# auth-rate-limit (5/min) is intentionally NOT used here — Kratos applies its
+# own per-flow protections.
+#
+# OPERATOR: confirm the cloudflare-origin-cert TLS secret covers
+# auth.myhoneydue.com (apex + wildcard origin cert), and add the
+# auth.myhoneydue.com DNS record in Cloudflare (proxied) → cluster ingress.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: honeydue-auth
+  namespace: honeydue
+  labels:
+    app.kubernetes.io/name: kratos
+    app.kubernetes.io/part-of: honeydue
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: honeydue-cloudflare-only@kubernetescrd,honeydue-security-headers@kubernetescrd,honeydue-rate-limit@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - auth.myhoneydue.com
+      secretName: cloudflare-origin-cert
+  rules:
+    - host: auth.myhoneydue.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: kratos
+                port:
+                  number: 4433