chore: add Dockerfile and k8s deployment manifests

.dockerignore

@@ -0,0 +1,3 @@
+data/
+.env
+node_modules/

Dockerfile

@@ -0,0 +1,14 @@
+FROM node:22-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM node:22-alpine
+WORKDIR /app
+COPY --from=builder /app/build ./build
+COPY --from=builder /app/package*.json ./
+RUN npm ci --omit=dev
+EXPOSE 3000
+CMD ["node", "build/index.js"]

k8s/deployment.yaml

@@ -0,0 +1,68 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: humor-units
+  labels:
+    app: humor-units
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: humor-units
+  template:
+    metadata:
+      labels:
+        app: humor-units
+    spec:
+      containers:
+        - name: humor-units
+          image: ghcr.io/YOUR_ORG/humor-units:latest  # replace with your registry
+          ports:
+            - containerPort: 3000
+          env:
+            - name: PORT
+              value: "3000"
+            - name: HOST
+              value: "0.0.0.0"
+            - name: ORIGIN
+              value: "https://humorunits.com"  # replace with your domain
+          envFrom:
+            - secretRef:
+                name: humor-units-secrets  # SESSION_SECRET, PASSWORD_HASH
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 30
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: humor-units-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: humor-units-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Mi

k8s/secrets.yaml

@@ -0,0 +1,16 @@
+# humor-units-secrets — do NOT commit real values
+# Create with:
+#   kubectl create secret generic humor-units-secrets \
+#     --from-literal=SESSION_SECRET=<your-secret> \
+#     --from-literal=PASSWORD_HASH=<bcrypt-hash>
+#
+# Or apply this manifest after filling in base64-encoded values:
+#   echo -n 'value' | base64
+apiVersion: v1
+kind: Secret
+metadata:
+  name: humor-units-secrets
+type: Opaque
+data:
+  SESSION_SECRET: ""   # base64-encoded
+  PASSWORD_HASH: ""    # base64-encoded bcrypt hash