fix: consolidate helmfile into one file; expose gRPC externally for kmsvc-cli

Cross-file `needs:` across separate nested helmfiles didn't resolve in
Helmfile v1 (releases defined in sibling files weren't visible to each
other's dependency graph) -- confirmed live against the homelab cluster:
kafka-cluster failed with "depend(s) on an undefined release" even though
strimzi-operator had just been installed successfully by a sibling file.
Collapsed releases.d/*.gotmpl into a single helmfile.yaml.gotmpl so the
whole release graph is resolved together.

Also add a second Ingress (management-service-grpc, backend-protocol: GRPC)
scoped to the QueueService gRPC path prefix on the same host/port as the
REST ingress. kmsvc-cli dials --server directly via gRPC (default
kmsvc.homelab.internal:443 per its README), so raw gRPC needs an external
path too, not just REST -- the original "gRPC stays internal" default
didn't account for the CLI's own connection model.

Add Dockerfile.queue-operator (existed for cmd/server only before).

k8s/helmfile.yaml.gotmpl

@@ -1,15 +1,99 @@
 environments:
+  default:
+    values:
+      - environments/homelab.yaml
   homelab:
     values:
       - environments/homelab.yaml
-
+---
 helmDefaults:
   wait: true
   timeout: 600
 
-helmfiles:
-  - path: releases.d/00-strimzi-operator.yaml.gotmpl
-  - path: releases.d/01-kafka-cluster.yaml.gotmpl
-  - path: releases.d/02-redis.yaml.gotmpl
-  - path: releases.d/03-queue-crd.yaml.gotmpl
-  - path: releases.d/04-management-service.yaml.gotmpl
+repositories:
+  - name: strimzi
+    url: https://strimzi.io/charts/
+  - name: bitnami
+    url: https://charts.bitnami.com/bitnami
+
+releases:
+  - name: strimzi-operator
+    namespace: {{ .Values.namespace }}
+    chart: strimzi/strimzi-kafka-operator
+    version: 0.46.0
+    values:
+      - watchNamespaces: ["{{ .Values.namespace }}"]
+
+  - name: kafka-cluster
+    namespace: {{ .Values.namespace }}
+    chart: charts/kafka-cluster
+    needs:
+      - {{ .Values.namespace }}/strimzi-operator
+    values:
+      - namespace: {{ .Values.namespace }}
+        nodePool:
+          replicas: {{ .Values.kafkaCluster.nodePool.replicas }}
+          storage:
+            class: {{ .Values.kafkaCluster.nodePool.storage.class }}
+            sizeGi: {{ .Values.kafkaCluster.nodePool.storage.sizeGi }}
+          resources:
+            memory: {{ .Values.kafkaCluster.nodePool.resources.memory }}
+            cpu: {{ .Values.kafkaCluster.nodePool.resources.cpu | quote }}
+
+  - name: kmsvc-redis
+    namespace: {{ .Values.namespace }}
+    chart: bitnami/redis
+    version: 20.6.0
+    values:
+      - architecture: standalone
+        # Bitnami stopped publishing version-pinned tags under docker.io/bitnami
+        # (only `latest` remains there); bitnamilegacy/* mirrors the old
+        # versioned tags for free, so pin there instead of floating on `latest`.
+        # The chart's container-image allowlist check doesn't know about the
+        # legacy mirror, hence allowInsecureImages.
+        global:
+          security:
+            allowInsecureImages: true
+        image:
+          repository: bitnamilegacy/redis
+        auth:
+          enabled: false
+        master:
+          persistence:
+            enabled: true
+            storageClass: {{ .Values.redis.storageClass }}
+            size: 2Gi
+          resources:
+            limits:
+              memory: {{ .Values.redis.memoryLimit }}
+            requests:
+              memory: {{ .Values.redis.memoryLimit }}
+
+  - name: queue-crd
+    namespace: {{ .Values.namespace }}
+    chart: charts/queue-crd
+    needs:
+      - {{ .Values.namespace }}/kafka-cluster
+      - {{ .Values.namespace }}/kmsvc-redis
+    values:
+      - namespace: {{ .Values.namespace }}
+        kafkaBrokers: "kmsvc-kafka-bootstrap.{{ .Values.namespace }}.svc.cluster.local:9092"
+        redisAddr: "kmsvc-redis-master.{{ .Values.namespace }}.svc.cluster.local:6379"
+
+  - name: management-service
+    namespace: {{ .Values.namespace }}
+    chart: charts/management-service
+    needs:
+      - {{ .Values.namespace }}/kafka-cluster
+      - {{ .Values.namespace }}/kmsvc-redis
+    values:
+      - namespace: {{ .Values.namespace }}
+        env:
+          kafkaBrokers: "kmsvc-kafka-bootstrap.{{ .Values.namespace }}.svc.cluster.local:9092"
+          redisAddr: "kmsvc-redis-master.{{ .Values.namespace }}.svc.cluster.local:6379"
+          authentikIssuerURL: {{ .Values.managementService.authentikIssuerURL | quote }}
+          authentikAudience: {{ .Values.managementService.authentikAudience | quote }}
+        ingress:
+          enabled: true
+          host: {{ .Values.managementService.ingress.host | quote }}
+          clusterIssuer: {{ .Values.managementService.ingress.clusterIssuer | quote }}