feat: OCI deployment — Terraform VM + OKE stacks, OCIR, K8s manifests

- terraform-vm/: ARM VM (A1.Flex Free Tier), Docker Compose, Block Volume, LB+WAF+SSL
- terraform-oke/: OKE cluster (3 nodes Intel), NodePort, LB+WAF+SSL
- k8s/: namespace, deployments, services, PVC, secrets, configmap
- Dockerfile.frontend: self-contained nginx+dist image
- push-images.sh: multi-arch build (amd64+arm64) + push to OCIR
- dns.tf: conditional OCI DNS Zone + A record (when domain available)
- Both stacks 100% independent, no shared modules
- .gitignore: terraform state, .terraform/, *.tfvars

deploy/terraform-oke/dns.tf

@@ -0,0 +1,29 @@
+# -----------------------------------------------------------------------------
+# OCI CIS Agent — OKE Deployment Stack
+# DNS: Conditional Zone + A Record (only when domain_name is set)
+# -----------------------------------------------------------------------------
+
+resource "oci_dns_zone" "main" {
+  count = var.domain_name != "" ? 1 : 0
+
+  compartment_id = var.compartment_ocid
+  name           = var.domain_name
+  zone_type      = "PRIMARY"
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_dns_rrset" "app_a_record" {
+  count = var.domain_name != "" ? 1 : 0
+
+  zone_name_or_id = oci_dns_zone.main[0].id
+  domain          = var.domain_name
+  rtype           = "A"
+  compartment_id  = var.compartment_ocid
+
+  items {
+    domain = var.domain_name
+    rdata  = oci_load_balancer_load_balancer.main.ip_address_details[0].ip_address
+    rtype  = "A"
+    ttl    = 300
+  }
+}