Add Kubernetes manifests for car.stinnesbeck.com

Namespace, InfluxDB 2.7.12 StatefulSet with PVC and a NetworkPolicy
that admits only the server, the server Deployment (non-root, read-only
root filesystem), a cert-manager Certificate from letsencrypt-prod and a
Traefik IngressRoute. Secrets are a template only. Nothing is applied;
k8s/README.md has the steps. Server version bumped to 1.1.0.

Validated offline with kustomize and kubeconform (including the
cert-manager and Traefik CRD schemas). The InfluxDB container was tested
locally as UID 1000 with no capabilities.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k8s/secrets.example.yaml

@@ -0,0 +1,34 @@
+# TEMPLATE ONLY — not part of kustomization.yaml. Copy it outside the repository, fill in
+# real values, and apply that copy yourself. Never commit the filled-in file.
+#
+#   openssl rand -hex 32     for every token and secret below
+apiVersion: v1
+kind: Secret
+metadata:
+  name: influxdb-auth
+  namespace: mg4
+type: Opaque
+stringData:
+  admin-password: CHANGE-ME-at-least-8-characters
+  admin-token: CHANGE-ME-openssl-rand-hex-32
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mg4-server
+  namespace: mg4
+type: Opaque
+stringData:
+  # The car's write token, entered in the app. At least 24 characters.
+  INGEST_TOKEN: CHANGE-ME-openssl-rand-hex-32
+  SESSION_SECRET: CHANGE-ME-openssl-rand-hex-32
+  DASHBOARD_PASSWORD: CHANGE-ME-at-least-8-characters
+  # Your ABRP credentials. Leave either empty to switch forwarding off.
+  ABRP_API_KEY: CHANGE-ME
+  ABRP_USER_TOKEN: CHANGE-ME
+  ABRP_MIN_INTERVAL_SECONDS: "5"
+---
+# Pull secret for a private image on git.stinnesbeck.com. Easier to create with:
+#   kubectl -n mg4 create secret docker-registry git-stinnesbeck-registry \
+#     --docker-server=git.stinnesbeck.com --docker-username=<user> --docker-password=<token>
+# If the package is public, remove imagePullSecrets from server.yaml instead.