feat: deploy to Frostmoln production (#391)

Moves the production deploy from AWS to the Frostmoln production cluster (namespace `schemas`), with unboundsoftware/schemas.

- `deploy-prod` (AWS, failing since CI left AWS) → `deploy-prod-frostmoln`: `deploy prod-frostmoln -n schemas`.
- Restricted Pod Security: `nginxinc/nginx-unprivileged` (uid 101, port 8080; 1.31.7 isn't published for it yet, so 1.31.6). `nginx.conf`: no `user`, pid and temp paths under `/tmp`, `listen 8080`. Configs copied with `--chmod=644`. Service is ClusterIP.
- `autoscale-prod`/`pdb-prod` → `-prod-frostmoln`; the ALB ingress → a Traefik one for `/` on `schemas.unbound.se` (the API's `/query` ingress wins on the longer path).

Checked locally (amd64): as uid 101 with all capabilities dropped, `/health`, `/` and SPA routes 200, security headers present.

**Merge with** the schemas PR, after infra#1878 is applied.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
Reviewed-on: #391

k8s/deploy.yaml

@@ -23,6 +23,11 @@ spec:
         app.kubernetes.io/name: schemas-app
         app.kubernetes.io/instance: schemas
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -39,19 +44,23 @@ spec:
       - name: schemas-app
         image: ${IMAGE}
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
         ports:
-        - containerPort: 80
+        - containerPort: 8080
         readinessProbe:
           httpGet:
             path: /
-            port: 80
+            port: 8080
           initialDelaySeconds: 5
           periodSeconds: 5
           timeoutSeconds: 5
         livenessProbe:
           httpGet:
             path: /
-            port: 80
+            port: 8080
           initialDelaySeconds: 10
           periodSeconds: 10
           timeoutSeconds: 5
@@ -71,9 +80,8 @@ metadata:
   labels:
     app.kubernetes.io/name: schemas-app
 spec:
-  type: NodePort
   selector:
     app.kubernetes.io/name: schemas-app
   ports:
   - port: 80
-    targetPort: 80
+    targetPort: 8080

k8s/ingress-prod-frostmoln.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: schemas-app
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: "schemas.unbound.se"
+      http:
+        paths:
+          # Everything but /query, which the schemas API's longer path takes.
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: schemas-app
+                port:
+                  number: 80

k8s/ingress-prod.yaml

@@ -1,25 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: schemas-app-ingress
-  annotations:
-    alb.ingress.kubernetes.io/group.name: "default"
-    alb.ingress.kubernetes.io/group.order: "15"
-    alb.ingress.kubernetes.io/scheme: internet-facing
-    alb.ingress.kubernetes.io/target-type: instance
-    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
-    alb.ingress.kubernetes.io/ssl-redirect: "443"
-    alb.ingress.kubernetes.io/healthcheck-path: '/'
-spec:
-  ingressClassName: "alb"
-  rules:
-    - host: "schemas.unbound.se"
-      http:
-        paths:
-          - path: /*
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: schemas-app
-                port:
-                  number: 80