fix: add kubectl apply to CI workflows and add production K8s manifest

Both kub-deploy and prod-deploy were only running kubectl rollout restart,
meaning changes to the deployment manifest (env vars, resources, image tag)
were never applied to the cluster.

- Add scp + kubectl apply before rollout restart in kub-deploy.yml (staging)
- Add scp + kubectl apply before rollout restart in prod-deploy.yml (production)
- Add k8s/production/frontoffice-deployment.yaml with ASPNETCORE_ENVIRONMENT=Production
  and image tag :prod

Co-authored-by: Cursor <cursoragent@cursor.com>

k8s/production/frontoffice-deployment.yaml

@@ -0,0 +1,56 @@
+---
+# FrontOffice (Blazor Server) production.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontoffice
+  namespace: default
+  labels:
+    app: frontoffice
+    environment: production
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: frontoffice
+  template:
+    metadata:
+      labels:
+        app: frontoffice
+    spec:
+      containers:
+        - name: frontoffice
+          image: 194.5.195.53:30080/admin/frontoffice:prod
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+              name: http
+          env:
+            - name: ASPNETCORE_ENVIRONMENT
+              value: "Production"
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+      imagePullSecrets:
+        - name: gitea-registry-secret
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontoffice-svc
+  namespace: default
+  labels:
+    app: frontoffice
+spec:
+  selector:
+    app: frontoffice
+  ports:
+    - port: 80
+      targetPort: 80
+      name: http
+  type: ClusterIP