feat(brochure): add public brochure GitOps app (#13)

apps/brochure/README.md

@@ -0,0 +1,27 @@
+# FlowerCore Brochure
+
+`apps/brochure` hosts the public brochure split from `FlowerCore.Intranet.Web`.
+ArgoCD's `apps/*` ApplicationSet will create `infra-brochure` after this
+directory lands on `main`.
+
+## Runtime
+
+- Host: `https://brochure.flowercore.io`
+- Namespace: `brochure`
+- Deployment: `brochure-web`
+- Image: `localhost/fc-brochure-web:v20260524-sprint32`
+- Port: `8080`
+- Public route method allowlist: `GET` and `HEAD`
+
+## Operator Actions
+
+1. Publish and import `localhost/fc-brochure-web:v20260524-sprint32` to every
+   RKE2 node before sync, using the same podman save + `ctr images import`
+   flow as the Intranet deployment.
+2. Create the Cloudflare DNS record for `brochure.flowercore.io` pointing at
+   the FlowerCore public edge.
+3. Verify `infra-brochure` appears in ArgoCD, the certificate becomes Ready,
+   and `GET https://brochure.flowercore.io/` returns `200`.
+
+The route intentionally does not expose `/ops/*` or `/admin/*`; the Brochure
+web app returns `404` for those paths and Traefik only forwards read methods.