fix(security): Haertung der minimalen k8s-Manifeste wiederhergestellt

Befunde des Commit-Security-Reviews: automountServiceAccountToken: false
fuer Postgres, App und Worker; Speicherlimits fuer Migrations-initContainer
und Worker; Laufzeitgrenze (activeDeadlineSeconds) fuer den Worker;
Groessenlimits fuer die emptyDir-Volumes.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

k8s/03-postgres.yaml

@@ -14,6 +14,7 @@ spec:
       labels:
         app: artista-modelcamp-postgres
     spec:
+      automountServiceAccountToken: false
       terminationGracePeriodSeconds: 120   # sauber herunterfahren vor dem Aushaengen
       securityContext:
         runAsNonRoot: true

k8s/04-app.yaml

@@ -16,6 +16,7 @@ spec:
         app: artista-modelcamp-app
         db-client: "true"
     spec:
+      automountServiceAccountToken: false
       securityContext:
         runAsNonRoot: true
         runAsUser: 1001
@@ -28,6 +29,8 @@ spec:
           command: ["prisma", "migrate", "deploy"]
           envFrom:
             - secretRef: { name: artista-modelcamp-secrets }
+          resources:
+            limits: { memory: 512Mi }
           securityContext:
             allowPrivilegeEscalation: false
             capabilities: { drop: ["ALL"] }
@@ -67,9 +70,9 @@ spec:
         - name: media
           persistentVolumeClaim: { claimName: artista-modelcamp-media }
         - name: cache
-          emptyDir: {}
+          emptyDir: { sizeLimit: 512Mi }
         - name: tmp
-          emptyDir: {}
+          emptyDir: { sizeLimit: 64Mi }
 ---
 apiVersion: v1
 kind: Service

k8s/06-worker.yaml

@@ -11,12 +11,14 @@ spec:
   jobTemplate:
     spec:
       backoffLimit: 1
+      activeDeadlineSeconds: 900
       template:
         metadata:
           labels:
             db-client: "true"
         spec:
           restartPolicy: Never
+          automountServiceAccountToken: false
           securityContext:
             runAsNonRoot: true
             runAsUser: 1001
@@ -29,6 +31,8 @@ spec:
               envFrom:
                 - configMapRef: { name: artista-modelcamp-config }
                 - secretRef: { name: artista-modelcamp-secrets }
+              resources:
+                limits: { memory: 512Mi }
               securityContext:
                 allowPrivilegeEscalation: false
                 capabilities: { drop: ["ALL"] }