fix(security): Haertung der minimalen k8s-Manifeste wiederhergestellt

Befunde des Commit-Security-Reviews: automountServiceAccountToken: false
fuer Postgres, App und Worker; Speicherlimits fuer Migrations-initContainer
und Worker; Laufzeitgrenze (activeDeadlineSeconds) fuer den Worker;
Groessenlimits fuer die emptyDir-Volumes.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

k8s/04-app.yaml

@@ -16,6 +16,7 @@ spec:
         app: artista-modelcamp-app
         db-client: "true"
     spec:
+      automountServiceAccountToken: false
       securityContext:
         runAsNonRoot: true
         runAsUser: 1001
@@ -28,6 +29,8 @@ spec:
           command: ["prisma", "migrate", "deploy"]
           envFrom:
             - secretRef: { name: artista-modelcamp-secrets }
+          resources:
+            limits: { memory: 512Mi }
           securityContext:
             allowPrivilegeEscalation: false
             capabilities: { drop: ["ALL"] }
@@ -67,9 +70,9 @@ spec:
         - name: media
           persistentVolumeClaim: { claimName: artista-modelcamp-media }
         - name: cache
-          emptyDir: {}
+          emptyDir: { sizeLimit: 512Mi }
         - name: tmp
-          emptyDir: {}
+          emptyDir: { sizeLimit: 64Mi }
 ---
 apiVersion: v1
 kind: Service