feat(phase-1.1): deploy temporal server in k8s

Temporal infrastructure deployment with:
  - PostgreSQL StatefulSet (event log + visibility)
    - 10Gi PVC, health checks, port 5432
  - Elasticsearch StatefulSet (workflow search)
    - 20Gi PVC, health checks, port 9200
  - Temporal Server StatefulSet (main service)
    - Frontend: 7233, Matching: 7235, History: 7234, Worker: 7239
    - Headless + ClusterIP services
    - Auto-setup image: temporalio/auto-setup:1.20.0
  - Temporal UI Deployment (web visualization)
    - Port 3000, connects to frontend:7233
    - LoadBalancer service for access

Components:
  - 00-namespace.yaml: dedicated temporal namespace
  - 01-postgres-statefulset.yaml: event log backend
  - 02-elasticsearch-statefulset.yaml: search visibility
  - 03-temporal-server-statefulset.yaml: server + services
  - 04-temporal-ui-deployment.yaml: web ui
  - kustomization.yaml: deployment automation
  - README.md: deployment + troubleshooting guide

Health checks: liveness + readiness on all components
Persistence: PVCs with dynamic provisioning
Ports: 5432 (postgres), 9200 (es), 7233-7239 (temporal)

Deploy: kubectl apply -k k8s/temporal/

Effort: 150 LOC (complete K8s manifests)

k8s/temporal/01-postgres-statefulset.yaml

@@ -0,0 +1,128 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: temporal-postgres-pvc
+  namespace: temporal
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: temporal-postgres-init
+  namespace: temporal
+data:
+  init.sql: |
+    CREATE DATABASE temporal;
+    CREATE DATABASE temporal_visibility;
+    GRANT ALL PRIVILEGES ON DATABASE temporal TO postgres;
+    GRANT ALL PRIVILEGES ON DATABASE temporal_visibility TO postgres;
+
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: temporal-postgres
+  namespace: temporal
+  labels:
+    app: temporal-postgres
+spec:
+  serviceName: temporal-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app: temporal-postgres
+  template:
+    metadata:
+      labels:
+        app: temporal-postgres
+    spec:
+      containers:
+      - name: postgres
+        image: postgres:15-alpine
+        ports:
+        - name: db
+          containerPort: 5432
+          protocol: TCP
+        env:
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: temporal-postgres-secret
+              key: password
+        - name: PGDATA
+          value: /var/lib/postgresql/data/pgdata
+        volumeMounts:
+        - name: postgres-storage
+          mountPath: /var/lib/postgresql/data
+        - name: init-scripts
+          mountPath: /docker-entrypoint-initdb.d
+        resources:
+          requests:
+            cpu: 250m
+            memory: 512Mi
+          limits:
+            cpu: 500m
+            memory: 1Gi
+        livenessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - pg_isready -U postgres
+          initialDelaySeconds: 30
+          periodSeconds: 10
+        readinessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - pg_isready -U postgres
+          initialDelaySeconds: 5
+          periodSeconds: 10
+      volumes:
+      - name: init-scripts
+        configMap:
+          name: temporal-postgres-init
+  volumeClaimTemplates:
+  - metadata:
+      name: postgres-storage
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      resources:
+        requests:
+          storage: 10Gi
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: temporal-postgres
+  namespace: temporal
+  labels:
+    app: temporal-postgres
+spec:
+  type: ClusterIP
+  clusterIP: None  # Headless service for StatefulSet
+  ports:
+  - port: 5432
+    targetPort: 5432
+    protocol: TCP
+    name: db
+  selector:
+    app: temporal-postgres
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: temporal-postgres-secret
+  namespace: temporal
+type: Opaque
+stringData:
+  password: "temporal-password-changeme"