feat: OCI deployment — Terraform VM + OKE stacks, OCIR, K8s manifests

- terraform-vm/: ARM VM (A1.Flex Free Tier), Docker Compose, Block Volume, LB+WAF+SSL
- terraform-oke/: OKE cluster (3 nodes Intel), NodePort, LB+WAF+SSL
- k8s/: namespace, deployments, services, PVC, secrets, configmap
- Dockerfile.frontend: self-contained nginx+dist image
- push-images.sh: multi-arch build (amd64+arm64) + push to OCIR
- dns.tf: conditional OCI DNS Zone + A record (when domain available)
- Both stacks 100% independent, no shared modules
- .gitignore: terraform state, .terraform/, *.tfvars

deploy/terraform-vm/storage.tf

@@ -0,0 +1,22 @@
+# -----------------------------------------------------------------------------
+# Block Volume for /data persistence
+# -----------------------------------------------------------------------------
+resource "oci_core_volume" "data" {
+  compartment_id      = var.compartment_ocid
+  availability_domain = data.oci_identity_availability_domains.ads.availability_domains[0].name
+  display_name        = "cisagent-data-vol"
+  size_in_gbs         = var.block_volume_size_gb
+  vpus_per_gb         = var.block_volume_vpus_per_gb
+  freeform_tags       = var.freeform_tags
+}
+
+resource "oci_core_volume_attachment" "data" {
+  attachment_type = "paravirtualized"
+  instance_id     = oci_core_instance.app.id
+  volume_id       = oci_core_volume.data.id
+  display_name    = "cisagent-data-vol-attach"
+  device          = "/dev/oracleoci/oraclevdb"
+
+  # Ensure instance is fully running before attaching
+  depends_on = [oci_core_instance.app]
+}