feat(brochure): add public brochure GitOps app

apps/brochure/brochure.yaml

@@ -0,0 +1,131 @@
+# FlowerCore Brochure public host
+#
+# Thin Blazor host for public What's New, walkthrough, and gallery content
+# carved out of FlowerCore.Intranet.Web. The ApplicationSet creates
+# infra-brochure from this directory after merge.
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: brochure
+  labels:
+    app.kubernetes.io/part-of: flowercore
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: brochure-web
+  namespace: brochure
+  labels:
+    app: brochure-web
+    app.kubernetes.io/name: brochure-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app: brochure-web
+  template:
+    metadata:
+      labels:
+        app: brochure-web
+        app.kubernetes.io/name: brochure-web
+        app.kubernetes.io/part-of: flowercore
+    spec:
+      containers:
+        - name: brochure-web
+          image: localhost/fc-brochure-web:v20260524-sprint32
+          imagePullPolicy: Never
+          ports:
+            - containerPort: 8080
+              name: http
+          env:
+            - name: ASPNETCORE_ENVIRONMENT
+              value: Production
+            - name: ASPNETCORE_URLS
+              value: "http://+:8080"
+          resources:
+            requests:
+              cpu: "25m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1654
+            runAsGroup: 1654
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: brochure-web
+  namespace: brochure
+  labels:
+    app: brochure-web
+    app.kubernetes.io/name: brochure-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  type: ClusterIP
+  selector:
+    app: brochure-web
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: brochure-web-tls
+  namespace: brochure
+spec:
+  secretName: brochure-web-tls
+  issuerRef:
+    name: step-ca-acme
+    kind: ClusterIssuer
+  dnsNames:
+    - brochure.flowercore.io
+  duration: 720h
+  renewBefore: 240h
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: brochure-web-public
+  namespace: brochure
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`brochure.flowercore.io`) && (Method(`GET`) || Method(`HEAD`))
+      kind: Rule
+      services:
+        - name: brochure-web
+          port: 8080
+  tls:
+    secretName: brochure-web-tls