Update agent deployment: HTTPS backend + MCP endpoints + improved resources

- Use HTTPS api.fuq.tv instead of internal service URL
- Update MCP endpoint to /api/mcp (HTTP endpoints)
- Increase resources: 500m-2000m CPU, 1-4Gi RAM
- Add serviceAccount for RBAC
- Update secrets template

Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>

k8s/frontend/deployment.yaml

@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: control-plane
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: frontend
+  template:
+    metadata:
+      labels:
+        app: frontend
+    spec:
+      imagePullSecrets:
+      - name: gitea-registry
+      containers:
+      - name: frontend
+        image: git.fuq.tv/admin/aiworker-frontend:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 3001
+        env:
+        - name: PORT
+          value: "3001"
+        - name: BACKEND_URL
+          value: "http://backend.control-plane.svc.cluster.local:3000"
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 3001
+          initialDelaySeconds: 10
+          periodSeconds: 30
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 3001
+          initialDelaySeconds: 5
+          periodSeconds: 10

k8s/frontend/ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: frontend
+  namespace: control-plane
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - app.fuq.tv
+    secretName: frontend-tls
+  rules:
+  - host: app.fuq.tv
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: frontend
+            port:
+              number: 3001

k8s/frontend/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontend
+  namespace: control-plane
+spec:
+  selector:
+    app: frontend
+  ports:
+  - name: http
+    port: 3001
+    targetPort: 3001
+  type: ClusterIP