feat(k8s): Helm chart for the whole stack on a single-node cluster (refs #25)

One chart whose values.yaml is a near-literal transcription of
infra/docker-compose.yml, rendered by three generic templates (Deployment, Job,
Service) over a `workloads` map — so the two stacks can be diffed by eye instead
of by archaeology, and adding a service is a values edit.

Platform-forced deviations, each commented where it appears:
- `args`, never `command`: compose replaces the image CMD, Kubernetes replaces the
  ENTRYPOINT. The chart fails to render on `command`, because the symptom (postgres
  refusing to run as root, Keycloak exec-ing `start-dev`) is nothing like the cause.
- The four Django services apply their own setup_configuration in the web pod
  rather than in a separate init Job: both scripts migrate, and without compose's
  depends_on they race the same database.
- OpenZaak and Objecten are addressed by service FQDN, because Django rejects a
  single-label host in a URL — the reason compose passes container IPs around.
- NodePorts, no ingress; databases are emptyDir until persistence.storageClass is
  set, so the stack comes up on a cluster with no CSI driver.

The upstream config inputs stay in the repo and become ConfigMaps via
infra/helm/seed-configmaps.sh — the Kubernetes sibling of infra/seed-config.sh —
so the compose stack and the chart cannot fork. infra/helm/registry.yaml runs an
in-cluster registry because Talos cannot side-load an image and a laptop-side one
needs a root-level firewall change.

infra/helm/big-reference/templates/deployments.yaml

@@ -0,0 +1,39 @@
+{{- range $name, $w := .Values.workloads }}
+{{- if and (ne $w.enabled false) (not $w.job) }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $name }}
+  labels:
+{{- include "big.labels" (dict "root" $ "name" $name) | nindent 4 }}
+spec:
+  replicas: 1
+  # Recreate, not RollingUpdate: single node, ReadWriteOnce volumes, and nothing
+  # here is HA — a second pod would just fight the first for the disk.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ $name }}
+      app.kubernetes.io/instance: {{ $.Release.Name }}
+  template:
+    metadata:
+      {{- /*
+        A ConfigMap mounted with subPath never picks up updates, so a portal whose
+        config.json content changed has to be rolled. Hashing only the values that
+        render it keeps the churn off the databases — an emptyDir database that is
+        recreated for no reason loses its data (see the runbook §6).
+      */}}
+      {{- range $w.files }}
+      {{- if hasPrefix "portal-config-" .configMap }}
+      annotations:
+        checksum/portal-config: {{ printf "%s|%v" $.Values.host (index $.Values.nodePorts "keycloak") | sha256sum }}
+      {{- end }}
+      {{- end }}
+      labels:
+{{- include "big.labels" (dict "root" $ "name" $name) | nindent 8 }}
+    spec:
+{{- include "big.podspec" (dict "root" $ "name" $name "w" $w) | nindent 6 }}
+{{- end }}
+{{- end }}