[Feature] Add an official Helm chart for Kubernetes deployments

[melihsunbul]

Problem

Self-hosting docs cover Docker and Docker Compose (docker-compose.prod.yml), but there's no supported path for running Quackback on Kubernetes. Operators who want a cluster deployment have to hand-roll manifests, and end up guessing at things the project has already made decisions about elsewhere:

• apps/web/Dockerfile documents a specific K8s migration pattern ("K8s deployments should set SKIP_MIGRATIONS=true and run migrations from a pre-upgrade Helm hook Job instead") that has no reference implementation.
• deploy/self-hosted/README.md suggests a Kubernetes CronJob as the alternative to pg_cron for the SLA-tick job, again with no example.

Proposed solution

Add a Helm chart under deploy/kubernetes/quackback that:

• Bundles the same Postgres + Dragonfly + MinIO stack docker-compose.prod.yml uses, so the chart is deployable standalone for evaluation.
• Supports pointing at external Postgres/Redis/S3 for production, same as the Docker path.
• Implements the pre-install/pre-upgrade migration hook Job the Dockerfile already describes.
• Adds an optional CronJob for the SLA-tick endpoint, matching the self-hosting docs' suggestion.
• Follows the security/defaults conventions of mainstream community Helm charts (non-root securityContext, generic image defaults, no hardcoded StorageClass, optional HPA/PodDisruptionBudget, imagePullSecrets support).

Acceptance criteria

• helm install/helm upgrade bring up a working instance with just secretKey, baseUrl, and an ingress host set.
• Migrations run via a Helm hook Job before the app rolls out; the app never races or double-runs them.
• postgres.enabled=false / dragonfly.enabled=false / minio.enabled=false cleanly switch to external services via externalDatabaseUrl / externalRedisUrl.
• helm lint passes with no warnings; helm template renders cleanly for both the bundled-datastore and external-datastore paths.
• Chart is documented (parameters, quick start, upgrade/uninstall notes) at a README alongside the chart.
• deploy/README.md and the root README.md link to the new chart.

Note on sequencing

I'd like to flag that this is independent of, and much smaller than, the ticketing/CRM/RBAC stack proposed in #283 — it touches only deploy/ and doesn't intersect with that work at all. I don't want it competing for review bandwidth with that stack, so please treat this (and the linked PR) as lower priority: it can sit until #283's PRs have been reviewed and merged.

A draft implementation is up at #323.