Deploy to production: GitHub Actions + ghcr.io + Kubernetes

- Switch from Gitea to GitHub Container Registry (ghcr.io)
- Add GitHub Actions workflow with Tailscale connectivity
- Update k8s manifests for cloud nodes and Traefik ingress
- Configure for turbo.kazcloud.dev domain
- Test deployment with home page text change

k8s/migrate-job.yaml

@@ -7,6 +7,7 @@ metadata:
     app: turbovault
     job: migrate
 spec:
+  backoffLimit: 3
   template:
     metadata:
       labels:
@@ -14,14 +15,14 @@ spec:
         job: migrate
     spec:
       restartPolicy: OnFailure
-      # For private registries, uncomment and create secret:
-      # imagePullSecrets:
-      # - name: registry-secret
+      # Pull images from private GitHub Container Registry
+      imagePullSecrets:
+      - name: ghcr-secret
       containers:
       - name: migrate
         # UPDATE THIS: Replace with your registry path (same as deployment.yaml)
-        image: gitea.kazcloud.dev/ryankazokas/turbovault-app:latest
-        command: ["bundle", "exec", "rails", "db:migrate"]
+        image: ghcr.io/ryankazokas/turbovault-app:latest
+        command: ["bin/rails", "db:migrate"]
         env:
         # Load from ConfigMap
         - name: RAILS_ENV
@@ -60,4 +61,3 @@ spec:
             secretKeyRef:
               name: turbovault-secrets
               key: SECRET_KEY_BASE
-      backoffLimit: 3