Single-file deployment under deploy/k8s/tavolo.yaml:
- Namespace, ConfigMap and Secret (placeholders) for the app
- Ephemeral Redis Deployment + Service (sessions and live games are
disposable, mirroring the docker-compose no-volume choice)
- App Deployment with an aerich-migrate initContainer so the schema is
upgraded before rollout, /api/health probes and a hardened pod
security context
- ClusterIP Service; Postgres and the OIDC provider stay in their own
namespaces and are referenced by DNS
