feat: OCI deployment — Terraform VM + OKE stacks, OCIR, K8s manifests

- terraform-vm/: ARM VM (A1.Flex Free Tier), Docker Compose, Block Volume, LB+WAF+SSL
- terraform-oke/: OKE cluster (3 nodes Intel), NodePort, LB+WAF+SSL
- k8s/: namespace, deployments, services, PVC, secrets, configmap
- Dockerfile.frontend: self-contained nginx+dist image
- push-images.sh: multi-arch build (amd64+arm64) + push to OCIR
- dns.tf: conditional OCI DNS Zone + A record (when domain available)
- Both stacks 100% independent, no shared modules
- .gitignore: terraform state, .terraform/, *.tfvars

deploy/k8s/service.yaml

@@ -0,0 +1,42 @@
+##
+## Backend service — ClusterIP (internal only)
+## Named "backend" so the frontend nginx proxy_pass http://backend:8000/api/ resolves via K8s DNS.
+##
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: oci-cis-agent
+  labels:
+    app: oci-cis-agent-backend
+spec:
+  type: ClusterIP
+  selector:
+    app: oci-cis-agent-backend
+  ports:
+    - port: 8000
+      targetPort: 8000
+      protocol: TCP
+
+---
+
+##
+## Frontend service — NodePort
+## nodePort 30080 matches the OCI Load Balancer backend set.
+##
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontend
+  namespace: oci-cis-agent
+  labels:
+    app: oci-cis-agent-frontend
+spec:
+  type: NodePort
+  selector:
+    app: oci-cis-agent-frontend
+  ports:
+    - port: 80
+      targetPort: 80
+      nodePort: 30080
+      protocol: TCP