feat: deploy to Frostmoln production

Replace the AWS deploy-prod job (failing since CI left AWS) with deploy-prod-frostmoln, and run under the restricted Pod Security profile with the namespace's oci-registry pull secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi

k8s/deploy.yaml

@@ -21,6 +21,13 @@ spec:
       labels:
         app.kubernetes.io/name: geo-service
     spec:
+      imagePullSecrets:
+        - name: oci-registry
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -35,6 +42,10 @@ spec:
                 topologyKey: kubernetes.io/hostname
       containers:
         - name: geo-service
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
           resources:
             limits:
               memory: "100Mi"
@@ -43,8 +54,11 @@ spec:
           imagePullPolicy: Always
           image: ${IMAGE}
           ports:
-            - containerPort: 80
+            - containerPort: 8080
               name: http
+          env:
+            - name: PORT
+              value: "8080"
           envFrom:
             - secretRef:
                 name: geo-service
@@ -59,7 +73,7 @@ spec:
     - port: 80
       name: http
       protocol: TCP
-      targetPort: 80
+      targetPort: 8080
   selector:
     app.kubernetes.io/name: geo-service
   type: ClusterIP

k8s/secrets-prod-frostmoln.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: geo-service
+spec:
+  refreshInterval: 1h
+  # The namespace's store (infra frostmoln/production/apps.tf); MAPS_API_KEY
+  # lives in the Frostmoln Secret "dancefinder", next to the API's settings
+  # (infra frostmoln/production/scripts/seed-app.sh).
+  secretStoreRef:
+    name: frostmoln
+    kind: SecretStore
+  target:
+    name: geo-service
+    template:
+      engineVersion: v2
+      data:
+        MAPS_API_KEY: "{{ .MAPS_API_KEY }}"
+  dataFrom:
+  - extract:
+      key: dancefinder

k8s/secrets.yaml

@@ -1,14 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: geo-service
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: external-secrets
-    kind: ClusterSecretStore
-  target:
-    creationPolicy: Owner
-  dataFrom:
-  - extract:
-      key: applications/dancefinder/geo-service