fix(k8s): persist documents and app backups, pin images, run hardened

Documents, avatars and the encrypted app backups lived in ./uploads and
./backups inside the container and were lost on every restart. The
backend now mounts the apicore-data volume at /data (configmap paths
/data/documents and /data/backups).

Both deployments pin the image to a CI build (sha-<commit>) with
imagePullPolicy IfNotPresent instead of :latest, run as uid 1000 with
seccomp RuntimeDefault, no privilege escalation and all capabilities
dropped. The frontend gets a liveness probe.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/backend/data-pvc.yaml

@@ -0,0 +1,15 @@
+# Persistenter Speicher fuer Dokumente, Avatare und die verschluesselten
+# App-Backups (ConfigMap: DOCUMENTS_STORAGE_PATH=/data/documents,
+# BACKUP_STORAGE_PATH=/data/backups). Im Cluster: StorageClass smb-app
+# (SMB 3.1.1 mit seal, uid/gid 1000 = User "node" aus dem Dockerfile).
+# ReadWriteMany, damit mehrere Backend-Replicas dieselben Dateien sehen.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: apicore-data
+spec:
+  accessModes: [ReadWriteMany]
+  storageClassName: smb-app
+  resources:
+    requests:
+      storage: 20Gi