feat: OCI deployment — Terraform VM + OKE stacks, OCIR, K8s manifests

- terraform-vm/: ARM VM (A1.Flex Free Tier), Docker Compose, Block Volume, LB+WAF+SSL
- terraform-oke/: OKE cluster (3 nodes Intel), NodePort, LB+WAF+SSL
- k8s/: namespace, deployments, services, PVC, secrets, configmap
- Dockerfile.frontend: self-contained nginx+dist image
- push-images.sh: multi-arch build (amd64+arm64) + push to OCIR
- dns.tf: conditional OCI DNS Zone + A record (when domain available)
- Both stacks 100% independent, no shared modules
- .gitignore: terraform state, .terraform/, *.tfvars

deploy/k8s/secret.yaml

@@ -0,0 +1,35 @@
+##
+## Fill in the placeholder values before applying.
+##
+## APP_SECRET: generate with  python -c "import secrets; print(secrets.token_hex(64))"
+##             then base64-encode it:  echo -n '<value>' | base64
+##
+## OCIR dockerconfigjson:
+##   kubectl create secret docker-registry ocir-credentials \
+##     --namespace oci-cis-agent \
+##     --docker-server=OCIR_REGION.ocir.io \
+##     --docker-username='OCIR_NAMESPACE/USERNAME' \
+##     --docker-password='AUTH_TOKEN' \
+##     --dry-run=client -o yaml
+##   Copy the .data[.dockerconfigjson] value below.
+##
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: app-secret
+  namespace: oci-cis-agent
+type: Opaque
+data:
+  APP_SECRET: "<BASE64_ENCODED_APP_SECRET>"
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ocir-credentials
+  namespace: oci-cis-agent
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: "<BASE64_ENCODED_DOCKER_CONFIG_JSON>"