feat(auth): scaffold Ory Kratos identity service — phase 1 (infrastructure)

First phase of replacing the hand-rolled auth (internal/services/auth_service.go
et al.) with Ory Kratos. This commit is infrastructure only — Kratos will run
but nothing consumes it yet; the Go API still does its own auth until phase 2.

Adds deploy-k3s/manifests/kratos/:
- configmap.yaml  — kratos.yml, identity schema, Google/Apple OIDC claim
                     mappers (no secrets in the ConfigMap)
- migrate-job.yaml — `kratos migrate sql`, run before the Deployment
- kratos.yaml     — Deployment (x2), Service, NetworkPolicies
- ingress.yaml    — auth.myhoneydue.com -> Kratos public API :4433
- README.md       — operator prerequisites + deploy runbook

Wiring:
- 02-setup-secrets.sh creates kratos-secrets, gated on a config.yaml `kratos:`
  block (DSN, cookie/cipher, SMTP URI, OIDC client secret, Apple key).
- 03-deploy.sh applies the Kratos manifests + runs the migrate Job, gated on
  the kratos-secrets Secret existing.

Both gates mean the existing stack deploys completely unaffected until the
operator completes the prerequisites (Neon `kratos` DB, auth.myhoneydue.com
DNS, Apple/Google OAuth apps, Kratos image version). Pre-production, so no
user-data migration — see manifests/kratos/README.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy-k3s/scripts/03-deploy.sh

@@ -264,6 +264,27 @@ if [[ -d "${MANIFESTS}/observability" ]]; then
   fi
 fi
 
+# --- Ory Kratos (identity service) ---
+# Applied only when kratos-secrets exists — i.e. the operator has completed the
+# Kratos prerequisites in deploy-k3s/manifests/kratos/README.md. Otherwise
+# skipped, so the existing stack deploys unaffected.
+if kubectl -n "${NAMESPACE}" get secret kratos-secrets >/dev/null 2>&1; then
+  log "Deploying Ory Kratos..."
+  kubectl apply -f "${MANIFESTS}/kratos/configmap.yaml"
+  # The migrate Job is immutable — delete any prior run, then apply + wait.
+  kubectl delete job kratos-migrate -n "${NAMESPACE}" --ignore-not-found --wait=true >/dev/null
+  kubectl apply -f "${MANIFESTS}/kratos/migrate-job.yaml"
+  if ! kubectl wait --namespace="${NAMESPACE}" --for=condition=complete --timeout=5m job/kratos-migrate; then
+    warn "Kratos migration Job failed — logs:"
+    kubectl logs -n "${NAMESPACE}" job/kratos-migrate --tail=100 || true
+    die "aborting: Kratos schema migration failed"
+  fi
+  kubectl apply -f "${MANIFESTS}/kratos/kratos.yaml"
+  kubectl apply -f "${MANIFESTS}/kratos/ingress.yaml"
+else
+  log "kratos-secrets not present — skipping Kratos deploy (see manifests/kratos/README.md)."
+fi
+
 # --- Wait for rollouts ---
 
 log "Waiting for rollouts..."
@@ -281,6 +302,9 @@ fi
 if kubectl -n "${NAMESPACE}" get daemonset alloy-logs >/dev/null 2>&1; then
   kubectl rollout status daemonset/alloy-logs -n "${NAMESPACE}" --timeout=120s
 fi
+if kubectl -n "${NAMESPACE}" get deployment kratos >/dev/null 2>&1; then
+  kubectl rollout status deployment/kratos -n "${NAMESPACE}" --timeout=180s
+fi
 
 # --- Done ---