Add Kubernetes manifests for car.stinnesbeck.com

Namespace, InfluxDB 2.7.12 StatefulSet with PVC and a NetworkPolicy
that admits only the server, the server Deployment (non-root, read-only
root filesystem), a cert-manager Certificate from letsencrypt-prod and a
Traefik IngressRoute. Secrets are a template only. Nothing is applied;
k8s/README.md has the steps. Server version bumped to 1.1.0.

Validated offline with kustomize and kubeconform (including the
cert-manager and Traefik CRD schemas). The InfluxDB container was tested
locally as UID 1000 with no capabilities.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k8s/ingress.yaml

@@ -0,0 +1,37 @@
+# TLS certificate from cert-manager. cert-manager does not watch Traefik IngressRoutes, so the
+# certificate is requested explicitly and the IngressRoute references its Secret.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: car-stinnesbeck-com
+  namespace: mg4
+spec:
+  secretName: car-stinnesbeck-com-tls
+  dnsNames:
+    - car.stinnesbeck.com
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mg4-server
+  namespace: mg4
+  annotations:
+    # CHECK: the class of your public-facing Traefik. Your internal example uses
+    # "traefik-internal"; this host must be served by the external one.
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`car.stinnesbeck.com`)
+      services:
+        - kind: Service
+          name: mg4-server
+          namespace: mg4
+          port: 80
+  tls:
+    secretName: car-stinnesbeck-com-tls