fix: cleanup k8s configs, add deploy.sh, remove hardcoded secrets

- Add one-click deploy script (k8s/deploy.sh) for test + prod
- Add startupProbe to backend (60x10s = 10min grace for ML model loading)
- Add configmap.yaml and secret.yaml (envsubst from backend/.env)
- Fix image URLs: add registry.plfai.cn prefix
- Fix frontend: API base URL relative (/api/v1), login-required mode
- Remove hardcoded localhost references from frontend
- Clean broken kustomize overlays
- Add nodeAffinity for backend→k8smaster, frontend→plf-cvm/k8smaster
- Remove dead ReplicaSets and stale pods during deploy

k8s/base/configmap.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: graphrag-config
+data:
+  DEEPSEEK_BASE_URL: "https://api.deepseek.com"
+  MINERU_PIPELINE: "/app/mineru_mvp/pipeline.py"
+  MINERU_PYTHON: "/opt/venv/bin/python"
+  KEYCLOAK_SERVER_URL: "https://keycloak.plfai.cn"
+  KEYCLOAK_REALM: "plfai"
+  KEYCLOAK_CLIENT_ID: "graphrag-backend"
+  KEYCLOAK_AUDIENCE: "account"