deploy(irc): add gx10 management web app

apps-gx10/irc/irc.yaml

@@ -1335,6 +1335,168 @@ spec:
       targetPort: 9000
       name: http
 ---
+# FlowerCore IRC management web app data
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: irc-web-data
+  namespace: irc
+  labels:
+    app: irc-web
+    app.kubernetes.io/name: irc-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 1Gi
+---
+# FlowerCore IRC management web app.
+# External irc-admin.iamworkin.lan route is intentionally held until the
+# FlowerCore.DNS default tenant onboarding gate allows a 10.0.57.202 A record.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: irc-web
+  namespace: irc
+  labels:
+    app: irc-web
+    app.kubernetes.io/name: irc-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: irc-web
+  template:
+    metadata:
+      labels:
+        app: irc-web
+        app.kubernetes.io/name: irc-web
+        app.kubernetes.io/part-of: flowercore
+      annotations:
+        fc.flowercore.io/healthz-anon: "true"
+        fc.flowercore.io/probe-path: "/healthz"
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "5080"
+        prometheus.io/path: "/metrics/prometheus"
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1654
+        runAsGroup: 1654
+        fsGroup: 1654
+        fsGroupChangePolicy: OnRootMismatch
+      containers:
+        - name: web
+          image: localhost/fc-irc-web:v20260619-irc2-699f0d1
+          imagePullPolicy: Never
+          ports:
+            - containerPort: 5080
+              name: http
+          env:
+            - name: ASPNETCORE_URLS
+              value: "http://+:5080"
+            - name: ASPNETCORE_ENVIRONMENT
+              value: "Production"
+            - name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
+              value: "false"
+            - name: HOME
+              value: "/data"
+            - name: FlowerCore__IRC__BaseUrl
+              value: "http://irc-web.irc.svc.cluster.local"
+            - name: FlowerCore__IRC__Persistence__Provider
+              value: "Sqlite"
+            - name: FlowerCore__IRC__Persistence__ConnectionString
+              value: "Data Source=/data/irc-web.db"
+            - name: FlowerCore__IRC__Persistence__DefaultTenantId
+              value: "default"
+            - name: FlowerCore__IRC__ServerManagement__NetworkName
+              value: "BlueJayIRC"
+            - name: FlowerCore__IRC__ServerManagement__Host
+              value: "irc.iamworkin.lan"
+            - name: FlowerCore__IRC__ServerManagement__TlsPort
+              value: "6697"
+            - name: FlowerCore__Mcp__ServiceName
+              value: "fc-irc"
+            - name: FlowerCore__Mcp__RoutePath
+              value: "/mcp"
+            - name: FlowerCore__Mcp__RequireAuthorization
+              value: "false"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 384Mi
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1654
+            runAsGroup: 1654
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp
+            - name: logs
+              mountPath: /app/logs
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: 5080
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 5080
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 5080
+            initialDelaySeconds: 30
+            periodSeconds: 30
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: irc-web-data
+        - name: tmp
+          emptyDir: {}
+        - name: logs
+          emptyDir: {}
+---
+# FlowerCore IRC management web app Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: irc-web
+  namespace: irc
+  labels:
+    app: irc-web
+    app.kubernetes.io/name: irc-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  type: ClusterIP
+  selector:
+    app: irc-web
+  ports:
+    - name: http
+      port: 80
+      targetPort: 5080
+---
 # Traefik IngressRoute - The Lounge web IRC (webirc.iamworkin.lan)
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute