docs: add portable from-zero deploy runbook and GitOps templates

Document server-side rollout (values, Sealed Secrets, logging, greenfield
reset) with environment variables so any cluster can follow the same steps.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/sealed-secrets/abrban-platform-secrets.example.yaml

@@ -0,0 +1,30 @@
+# Example: seal platform secrets for namespace cloudhost.
+# Full guide (any environment): RUNBOOK-DEPLOY.fa.md — Phase 3
+# Real SealedSecret lives in cloud-host-gitops/sealed-secrets/ — never commit plaintext passwords.
+#
+# Required keys (must match backend Deployment + validate-production-config):
+#   postgres-password, jwt-secret, jwt-refresh-secret, cluster-kubeconfig-key, redis-password
+#
+# Generate (replace CHANGE_ME_* with strong random values):
+#
+#   kubectl -n cloudhost create secret generic abrban-platform-secrets \
+#     --from-literal=postgres-password='CHANGE_ME_PG' \
+#     --from-literal=jwt-secret='CHANGE_ME_JWT_32CHARS_MIN' \
+#     --from-literal=jwt-refresh-secret='CHANGE_ME_REFRESH_32CHARS_MIN' \
+#     --from-literal=cluster-kubeconfig-key='0123456789abcdef0123456789abcdef' \
+#     --from-literal=redis-password='CHANGE_ME_REDIS' \
+#     --dry-run=client -o json \
+#   | kubeseal \
+#       --controller-name=sealed-secrets-controller \
+#       --controller-namespace=kube-system \
+#       --format yaml \
+#   > ../cloud-host-gitops/sealed-secrets/abrban-platform-secrets.yaml
+#
+# Then in platform/values-abrban.yaml:
+#   secrets:
+#     existingSecret: abrban-platform-secrets
+#
+# Apply:
+#   kubectl apply -f ../cloud-host-gitops/sealed-secrets/abrban-platform-secrets.yaml
+#
+# Rotate redis-password: update SealedSecret, sync Argo, restart backend + redis pods.

gitops/sealed-secrets/elasticsearch-credentials.example.yaml

@@ -0,0 +1,20 @@
+# Example: seal Elasticsearch stack credentials (namespace logging).
+# Full guide (any environment): RUNBOOK-DEPLOY.fa.md — Phase 4
+# Apply elasticsearch-stack.yaml FIRST (without inline passwords), then create this Secret.
+#
+#   kubectl -n logging create secret generic elasticsearch-credentials \
+#     --from-literal=ELASTIC_PASSWORD="$(openssl rand -base64 24)" \
+#     --from-literal=FLUENTBIT_PASSWORD="$(openssl rand -base64 24)" \
+#     --dry-run=client -o json \
+#   | kubeseal \
+#       --controller-name=sealed-secrets-controller \
+#       --controller-namespace=kube-system \
+#       --format yaml \
+#   > ../cloud-host-gitops/sealed-secrets/elasticsearch-credentials.yaml
+#
+# Backend must receive the same ELASTIC_* values via backend.env in values-abrban.yaml
+# (or a separate SealedSecret referenced with envFrom).
+#
+# After deploy, verify:
+#   kubectl -n logging get secret elasticsearch-credentials
+#   curl -u elastic:$ELASTIC_PASSWORD https://elasticsearch.logging.svc.cluster.local:9200