fix(k8s): persist documents and app backups, pin images, run hardened

Documents, avatars and the encrypted app backups lived in ./uploads and
./backups inside the container and were lost on every restart. The
backend now mounts the apicore-data volume at /data (configmap paths
/data/documents and /data/backups).

Both deployments pin the image to a CI build (sha-<commit>) with
imagePullPolicy IfNotPresent instead of :latest, run as uid 1000 with
seccomp RuntimeDefault, no privilege escalation and all capabilities
dropped. The frontend gets a liveness probe.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/backend/deployment.yaml

@@ -14,9 +14,35 @@ spec:
       labels:
         app: apicore-backend
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        # Dokumente, Avatare und App-Backups (DOCUMENTS_STORAGE_PATH /
+        # BACKUP_STORAGE_PATH unter /data). Ohne Volume landen sie im
+        # Container und sind beim naechsten Neustart weg.
+        - name: data
+          persistentVolumeClaim:
+            claimName: apicore-data
       containers:
         - name: apicore-backend
-          image: git.encry.de/nick.rosenloecher/apicore-backend:latest
+          # Fest auf einen Build pinnen (Tag sha-<commit> aus der CI oder Digest),
+          # nicht :latest - sonst gibt es kein Rollback und jeder Neustart zieht
+          # ungeprueft das neueste Image. Ausrollen:
+          #   kubectl -n apicore set image deploy/apicore-backend \
+          #     apicore-backend=git.encry.de/nick.rosenloecher/apicore-backend:sha-<commit>
+          image: git.encry.de/nick.rosenloecher/apicore-backend:sha-REPLACE_ME
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: data
+              mountPath: /data
           ports:
             - containerPort: 3001
           envFrom: