Add coulomb-social Helm chart and deploy targets

Chart mirrors vergabe-teilnahme Django probe/secret pattern. Non-secret
values pin KeyCape OIDC and user-engine URL; env Secret holds secrets.
Makefile: dry-run, deploy, ingress, status, logs.

helm/coulomb-social-values.yaml

@@ -0,0 +1,24 @@
+# Production overrides for coulomb-social.
+# Non-secret values only. Secrets live in K8s Secret coulomb-social-env.
+
+image:
+  repository: forgejo.coulomb.social/coulomb/coulomb-social
+  tag: "pending"   # pin to git SHA after first image publish
+
+env:
+  DJANGO_SETTINGS_MODULE: coulomb_social.settings.prod
+  ALLOWED_HOSTS: coulomb.social,localhost
+  CSRF_TRUSTED_ORIGINS: https://coulomb.social
+  DEFAULT_TENANT_ID: "tenant:coulomb"
+  OIDC_ENABLED: "true"
+  OIDC_ISSUER: https://kc.coulomb.social
+  OIDC_CLIENT_ID: coulomb-social
+  OIDC_REDIRECT_URI: https://coulomb.social/auth/callback/
+  OIDC_SCOPES: "openid profile email groups"
+  USER_ENGINE_BASE_URL: https://users.92-205-62-239.nip.io
+  USER_ENGINE_APPLICATION_ID: coulomb-social
+  USER_ENGINE_EXPECTED_AUDIENCE: user-engine-portal
+
+probes:
+  hostHeader: coulomb.social
+  path: /healthz