feat(infra): add K3s GitOps infrastructure and Packer golden image build (#25)

### Summary of Changes

This PR introduces a declarative, GitOps-managed cloud infrastructure
for the monorepo using K3s, Flux v2, and HashiCorp Packer:

1. **Packer Golden Image Builder (`ci/packer/`)**:
- Automated Debian 12 minimal base OS image creation using QEMU builder,
UEFI firmware, GPT partition scheme, and 2M cluster size `.qcow2`
conversion.
- Cloud-init, `virtio` kernel drivers, and serial console (`ttyS0`,
115200 baud).
- Pre-installed K3s binary (`v1.31.2+k3s1`) with isolated first-boot
token and cert generation.
   - Full identity sanitization (`machine-id` and SSH host key resets).

2. **First-Boot Cloud-Init Bootstrapping
(`ci/cloud-init/user-data.yaml`)**:
- Configures K3s with `servicelb` disabled and TLS SANs for custom
domains and static IP.
- Waits for API readiness, initializes `flux-system` namespace, injects
`sops-age` secret, and triggers Flux sync.

3. **SOPS & GitOps Root Orchestration (`.sops.yaml`,
`ci/k8s/clusters/production/`)**:
- SOPS encryption configuration targeting Kubernetes secrets with `age`
key recipient.
- Flux v2 `GitRepository` and `Kustomization` manifests tracking `next`.

4. **Infrastructure & Networking (`ci/k8s/base/`,
`ci/k8s/infrastructure/`)**:
   - Dedicated `com-ermnvldmr` namespace.
- `cert-manager` HTTP-01 `ClusterIssuer` (`letsencrypt-prod` &
`letsencrypt-staging`).
- Traefik Ingress routing for `ermnvldmr.com`, `www.ermnvldmr.com`,
`docs.ermnvldmr.com`, and `analytics.ermnvldmr.com`.

5. **PostgreSQL & Applications (`ci/k8s/apps/`)**:
- PostgreSQL 16 StatefulSet on 5Gi `local-path` persistent storage with
low-memory tuning.
- Deployments for `www` (pinned `sha-6d33b71`), `docs` (pinned
`sha-91f5245`), and `umami` (pinned `postgresql-v2.14.0`) with
zero-downtime rolling update strategy.

6. **CI/CD Workflows (`.github/workflows/`)**:
- `ci - next/build-golden-image`: Workflow to build and upload
`com-ermnvldmr-debian-12-k3s-amd64-<tag>.qcow2` to static S3
`/dev/images/`.
- Updated `services-www-releases-dispatch-release.yml` and
`services-docs-next-required.yml` with GitOps deployment steps.

ci/packer/debian-12-k3s.pkr.hcl

@@ -0,0 +1,75 @@
+packer {
+  required_plugins {
+    qemu = {
+      version = ">= 1.1.0"
+      source  = "github.com/hashicorp/qemu"
+    }
+  }
+}
+
+variable "debian_iso_url" {
+  type    = string
+  default = "https://cdimage.debian.org/cdimage/archive/12.8.0/amd64/iso-cd/debian-12.8.0-amd64-netinst.iso"
+}
+
+variable "debian_iso_checksum" {
+  type    = string
+  default = "file:https://cdimage.debian.org/cdimage/archive/12.8.0/amd64/iso-cd/SHA512SUMS"
+}
+
+variable "vm_name" {
+  type    = string
+  default = "com-ermnvldmr-debian-12-k3s-amd64.qcow2"
+}
+
+source "qemu" "debian_k3s" {
+  iso_url          = var.debian_iso_url
+  iso_checksum     = var.debian_iso_checksum
+  output_directory = "output-qemu"
+  shutdown_command = "echo 'packer' | sudo -S shutdown -P now"
+  disk_size        = "10G"
+  format           = "qcow2"
+  accelerator      = "kvm"
+  http_directory   = "ci/packer/http"
+  ssh_username     = "root"
+  ssh_password     = "packer"
+  ssh_timeout      = "25m"
+  vm_name          = var.vm_name
+  net_device       = "virtio-net"
+  disk_interface   = "virtio"
+  efi_boot         = true
+
+  qemuargs = [
+    ["-m", "2048M"],
+    ["-smp", "2"],
+    ["-serial", "mon:stdio"]
+  ]
+
+  boot_wait = "5s"
+  boot_command = [
+    "<wait><wait><wait>c<wait>",
+    "linux /install.amd/vmlinuz auto=true priority=critical preseed/url=http://{{ .HTTPIP }}:{{ .HTTPPort }}/preseed.cfg --- quiet<enter>",
+    "initrd /install.amd/initrd.gz<enter>",
+    "boot<enter>"
+  ]
+}
+
+build {
+  sources = ["source.qemu.debian_k3s"]
+
+  provisioner "shell" {
+    scripts = [
+      "ci/packer/scripts/01-base-system.sh",
+      "ci/packer/scripts/02-install-k3s.sh",
+      "ci/packer/scripts/03-cleanup.sh"
+    ]
+  }
+
+  post-processor "shell-local" {
+    inline = [
+      "echo 'Optimizing qcow2 image with 2M cluster size...'",
+      "qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c output-qemu/${var.vm_name} output-qemu/debian-12-k3s-optimized.qcow2",
+      "mv output-qemu/debian-12-k3s-optimized.qcow2 output-qemu/${var.vm_name}"
+    ]
+  }
+}