feat: deploy to Frostmoln production (#3100)

Part of the dancefinder.unbound.se cutover to Frostmoln Production (infra: unboundsoftware/infra#1896, already applied).

- Replaces the AWS `deploy-prod` job (failing since CI left AWS) with `deploy-prod-frostmoln` (`deploy prod-frostmoln -n dancefinder`), as schemas did.
- Restricted securityContext (runAsNonRoot, drop ALL, seccomp RuntimeDefault) and `imagePullSecrets: oci-registry` (Platform registry).
- Switches to `nginxinc/nginx-unprivileged` (same pin as schemas-app), listening on 8080 as uid 101; the Service keeps port 80. Traefik Ingress for `/`, PDB, HPA moved to `-prod-frostmoln`; ALB Ingress dropped; Service ClusterIP.

Merging deploys to Frostmoln only; DNS still points at AWS until the cutover.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi
Reviewed-on: https://gitea.unbound.se/dancefinder/dancefinder-app/pulls/3100

k8s/deploy.yaml

@@ -22,6 +22,13 @@ spec:
       labels:
         app.kubernetes.io/name: dancefinder-app
     spec:
+      imagePullSecrets:
+      - name: oci-registry
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -36,17 +43,21 @@ spec:
               topologyKey: kubernetes.io/hostname
       containers:
       - name: dancefinder-app
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
         readinessProbe:
           httpGet:
             path: /health
-            port: 80
+            port: 8080
           initialDelaySeconds: 5
           periodSeconds: 5
           timeoutSeconds: 5
         imagePullPolicy: Always
         image: ${IMAGE}
         ports:
-        - containerPort: 80
+        - containerPort: 8080
         resources:
           requests:
             cpu: 10m
@@ -64,9 +75,8 @@ metadata:
   labels:
     app.kubernetes.io/name: dancefinder-app
 spec:
-  type: NodePort
   selector:
     app.kubernetes.io/name: dancefinder-app
   ports:
   - port: 80
-    targetPort: 80
+    targetPort: 8080