Add coulomb-social Helm chart and deploy targets

Chart mirrors vergabe-teilnahme Django probe/secret pattern. Non-secret
values pin KeyCape OIDC and user-engine URL; env Secret holds secrets.
Makefile: dry-run, deploy, ingress, status, logs.

docs/coulomb-social.md

@@ -0,0 +1,35 @@
+# coulomb.social on Railiance
+
+Source repo: `coulomb/coulomb-social`  
+Chart: `charts/coulomb-social`  
+Values: `helm/coulomb-social-values.yaml`  
+Ingress: `manifests/coulomb-social-ingress.yaml`
+
+## Prerequisites
+
+- Image published: `forgejo.coulomb.social/coulomb/coulomb-social:<sha>`
+- KeyCape client `coulomb-social` registered (see source repo `scripts/register-keycape-client.sh`)
+- K8s Secret `coulomb-social-env` in namespace `coulomb-social` with at least:
+  - `SECRET_KEY`
+  - `DATABASE_URL` (or platform DB handoff)
+  - `USER_ENGINE_PROXY_SECRET` (from user-engine-runtime)
+- DNS `coulomb.social` → cluster ingress IP
+
+## Deploy
+
+```bash
+COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-dry-run
+COULOMB_SOCIAL_IMAGE_TAG=<git-sha> make coulomb-social-deploy
+make coulomb-social-ingress-deploy
+make coulomb-social-status
+```
+
+## Identity
+
+- OIDC issuer: `https://kc.coulomb.social`
+- user-engine: `https://users.92-205-62-239.nip.io` (trusted proxy)
+- flex-auth: leave `FLEX_AUTH_BASE_URL` unset until app PDP Service is ready (local vocabulary in-app)
+
+## Probe host
+
+`probes.hostHeader` must stay in `ALLOWED_HOSTS` (see `docs/django-on-railiance.md`).