Add me.nik4nao.com deployment

Same pattern as portfolio: Namespace, Deployment (pulls
gitea.nik4nao.com/nik/me.nik4nao.com:latest), Service, Let's Encrypt
Certificate, and Traefik IngressRoute for me.nik4nao.com, reconciled
by a new Argo CD Application. Includes the per-namespace registry
pull-secret script (run manually against the live cluster, not
committed as plaintext).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019KS514CDC88M4wDwMLnS7u

argocd/apps/me-nik4nao-com.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: me-nik4nao-com
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    targetRevision: main
+    path: manifests/me-nik4nao-com
+    directory:
+      recurse: true
+      include: '*.yaml'
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: me-nik4nao-com
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

manifests/me-nik4nao-com/me-nik4nao-com.yaml

@@ -0,0 +1,97 @@
+# Apply: kubectl apply -f manifests/me-nik4nao-com/me-nik4nao-com.yaml
+# Delete: kubectl delete -f manifests/me-nik4nao-com/me-nik4nao-com.yaml
+# Description: me.nik4nao.com (terminal-style personal site) deployment, service, TLS certificate, and public IngressRoute. Same pattern as manifests/portfolio.
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: me-nik4nao-com
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: me-nik4nao-com
+  namespace: me-nik4nao-com
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: me-nik4nao-com
+  template:
+    metadata:
+      labels:
+        app: me-nik4nao-com
+    spec:
+      imagePullSecrets:
+        - name: gitea-registry
+      containers:
+        - name: me-nik4nao-com
+          image: gitea.nik4nao.com/nik/me.nik4nao.com:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: me-nik4nao-com
+  namespace: me-nik4nao-com
+spec:
+  selector:
+    app: me-nik4nao-com
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: me-nik4nao-com-tls
+  namespace: me-nik4nao-com
+spec:
+  secretName: me-nik4nao-com-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - me.nik4nao.com
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: me-nik4nao-com
+  namespace: me-nik4nao-com
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`me.nik4nao.com`)
+      kind: Rule
+      middlewares:
+        - name: me-nik4nao-com-ratelimit
+      services:
+        - name: me-nik4nao-com
+          port: 80
+  tls:
+    secretName: me-nik4nao-com-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: me-nik4nao-com-ratelimit
+  namespace: me-nik4nao-com
+spec:
+  rateLimit:
+    average: 50
+    burst: 100
+    period: 1m
+    sourceCriterion:
+      ipStrategy:
+        depth: 1

manifests/me-nik4nao-com/registry-secret.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Usage: bash manifests/me-nik4nao-com/registry-secret.sh
+# Description: Creates the Gitea container registry pull secret for the me-nik4nao-com namespace
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../../.env"
+
+kubectl create secret docker-registry gitea-registry \
+  --namespace me-nik4nao-com \
+  --docker-server="$REGISTRY_SERVER" \
+  --docker-username="$REGISTRY_USER" \
+  --docker-password="$REGISTRY_PASSWORD" \
+  --dry-run=client -o yaml | kubectl apply -f -