Implement NetKingdom identity shell for coulomb.social (CSOC-WP-0002)

Django scaffold aligned with the business delivery lane: tenant-keyed
Member model without passwords, identity app as sole OIDC/session
boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and
tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP,
flex-auth, and packaging remain open.

docs/deploy.md

@@ -0,0 +1,25 @@
+# Deploy notes (stub — CSOC-WP-0002-T08)
+
+## Shape
+
+Standalone service: commit-SHA images → registry
+`gitea.coulomb.social/coulomb/coulomb-social` → `railiance-apps` values →
+railiance01 (same lane as `vergabe-teilnahme`).
+
+## Runtime secrets (names only)
+
+| Secret | Consumer |
+|--------|----------|
+| `SECRET_KEY` | Django |
+| `DATABASE_URL` | Django |
+| `OIDC_CLIENT_SECRET` | identity app |
+| future DB password | OpenBao dynamic/KV |
+
+## Health
+
+- `GET /healthz` → `{"status":"ok"}`
+
+## Status
+
+Container packaging and railiance-apps values are **not** finished; local
+`runserver` / tests are the current verification path.