chore: add Dockerfile and k8s deployment manifests

k8s/secrets.yaml

@@ -0,0 +1,16 @@
+# humor-units-secrets — do NOT commit real values
+# Create with:
+#   kubectl create secret generic humor-units-secrets \
+#     --from-literal=SESSION_SECRET=<your-secret> \
+#     --from-literal=PASSWORD_HASH=<bcrypt-hash>
+#
+# Or apply this manifest after filling in base64-encoded values:
+#   echo -n 'value' | base64
+apiVersion: v1
+kind: Secret
+metadata:
+  name: humor-units-secrets
+type: Opaque
+data:
+  SESSION_SECRET: ""   # base64-encoded
+  PASSWORD_HASH: ""    # base64-encoded bcrypt hash