convert deploy manifests to kustomization format

Adds kustomization.yaml to enforce explicit resource ordering
(namespace before deployment/service). Updates CI to use
kubectl apply -k instead of kubectl apply -f.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/kubernetes-deploy.yaml

@@ -106,4 +106,4 @@ jobs:
           kubectl auth whoami
           kubectl get ns
 
-          kubectl apply -f deploy/
+          kubectl apply -k deploy/