Add coulomb-social Helm chart and deploy targets

Chart mirrors vergabe-teilnahme Django probe/secret pattern. Non-secret
values pin KeyCape OIDC and user-engine URL; env Secret holds secrets.
Makefile: dry-run, deploy, ingress, status, logs.

charts/coulomb-social/values.yaml

@@ -0,0 +1,73 @@
+image:
+  repository: forgejo.coulomb.social/coulomb/coulomb-social
+  tag: ""
+  pullPolicy: IfNotPresent
+
+replicaCount: 1
+
+service:
+  type: ClusterIP
+  port: 80
+  targetPort: 8000
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+
+# Secrets (SECRET_KEY, DATABASE_URL, OIDC_*, USER_ENGINE_PROXY_SECRET, …)
+envSecretName: coulomb-social-env
+
+env:
+  DJANGO_SETTINGS_MODULE: coulomb_social.settings.prod
+  ALLOWED_HOSTS: coulomb.social,localhost
+  CSRF_TRUSTED_ORIGINS: https://coulomb.social
+  DEFAULT_TENANT_ID: "tenant:coulomb"
+  OIDC_ENABLED: "true"
+  OIDC_ISSUER: https://kc.coulomb.social
+  OIDC_CLIENT_ID: coulomb-social
+  OIDC_REDIRECT_URI: https://coulomb.social/auth/callback/
+  OIDC_SCOPES: "openid profile email groups"
+  USER_ENGINE_APPLICATION_ID: coulomb-social
+  USER_ENGINE_EXPECTED_AUDIENCE: user-engine-portal
+  # USER_ENGINE_BASE_URL set via secret or here when stable
+  USER_ENGINE_BASE_URL: https://users.92-205-62-239.nip.io
+
+probes:
+  enabled: true
+  path: /healthz
+  port: 8000
+  hostHeader: coulomb.social
+  liveness:
+    initialDelaySeconds: 30
+    periodSeconds: 30
+    timeoutSeconds: 5
+    failureThreshold: 3
+  readiness:
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+
+persistence:
+  media:
+    enabled: false
+
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 10001
+  runAsGroup: 10001
+  fsGroup: 10001
+
+securityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop: ["ALL"]
+
+nodeSelector: {}
+tolerations: []
+affinity: {}