WP-0011: deploy scaffolding for revenue.coulomb.social

Record T01 package (in-repo k8s/railiance, combined /ui + API app,
dedicated CNPG). Add Dockerfile, healthz, migration/bootstrap scripts,
kustomize manifests, ArgoCD Application (in railiance-platform), and
docs/deployment.md. T05 left open for operator DNS/OpenBao/image push.

k8s/railiance/externalsecret.yaml

@@ -0,0 +1,46 @@
+# Runtime secrets for Trust Service + Control Plane (WP-0011).
+#
+# OpenBao path (platform KV v2): workloads/target-revenue/runtime-secrets
+# Fields:
+#   TRF_SIGNING_KEY_HEX          — 64 hex chars Ed25519 seed (32 bytes)
+#   TRF_CONTROL_PLANE_SECRET_KEY — session cookie signing secret
+#   TRF_DATABASE_URL             — psycopg DSN for trf_app role
+#   TRF_MIGRATE_DATABASE_URL     — DSN for trf_owner (migrate/bootstrap Jobs)
+#
+# Pre-reqs: ESO + ClusterSecretStore openbao (railiance-platform);
+# OpenBao policy granting read of the path above.
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: target-revenue-runtime
+  namespace: target-revenue
+  labels:
+    app.kubernetes.io/name: target-revenue
+    app.kubernetes.io/part-of: target-revenue
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: openbao
+    kind: ClusterSecretStore
+  target:
+    name: target-revenue-runtime
+    creationPolicy: Owner
+  data:
+    - secretKey: TRF_SIGNING_KEY_HEX
+      remoteRef:
+        key: workloads/target-revenue/runtime-secrets
+        property: TRF_SIGNING_KEY_HEX
+    - secretKey: TRF_CONTROL_PLANE_SECRET_KEY
+      remoteRef:
+        key: workloads/target-revenue/runtime-secrets
+        property: TRF_CONTROL_PLANE_SECRET_KEY
+    - secretKey: TRF_DATABASE_URL
+      remoteRef:
+        key: workloads/target-revenue/runtime-secrets
+        property: TRF_DATABASE_URL
+    - secretKey: TRF_MIGRATE_DATABASE_URL
+      remoteRef:
+        key: workloads/target-revenue/runtime-secrets
+        property: TRF_MIGRATE_DATABASE_URL