feat(k8s): add K8s manifests for all homelab services

traefik, gitea, adguard, nextcloud, errorpages, homepages,
uptime-kuma, kener, checkmk, headscale, dockmon, metube,
downtify, portainer, netronome, userbot

Includes Helm values, deployments, services, ingress routes,
configmaps, secrets (placeholders), postgres statefulsets,
kustomize overlays, and Traefik dynamic configuration.

adguardhome/k8s/ingress.yaml

@@ -0,0 +1,67 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-dev
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: adguard-service
+      port: 3000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-local
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)
+    kind: Rule
+    services:
+    - name: adguard-service
+      port: 3000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-prod
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)
+    kind: Rule
+    services:
+    - name: adguard-service
+      port: 3000
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-doh
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`)
+    kind: Rule
+    services:
+    - name: adguard-service
+      port: 3000
+  tls:
+    {}