feat(infra): Meet integration, La Suite theming, Pingora SSH + meet routes

Meet: add backend/frontend/celery deployments and services, meet-config
ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS,
meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client.

La Suite overlay discipline: move people/docs frontend nginx ConfigMaps
and patches from overlays/local to base so both environments share them.
Remove values-ory.yaml (folded into base). Add docs-frontend nginx config
with sub_filter theming. Add local gitea mkcert CA patch.

Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and
split meet route into frontend default + backend paths for /api/, /admin/,
/oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production
overlay (host ports moved to patch-pingora-hostport.yaml).

Update both overlay kustomizations to reference all new resources and
add meet-backend/meet-frontend image entries.

base/ingress/pingora-deployment.yaml

@@ -23,6 +23,7 @@ spec:
       containers:
         - name: pingora
           image: sunbeam-proxy:latest   # overridden per overlay via kustomize images:
+          imagePullPolicy: IfNotPresent  # pre-seeded into containerd; avoids pull deadlock on startup
           ports:
             - name: http
               containerPort: 80
@@ -30,6 +31,9 @@ spec:
             - name: https
               containerPort: 443
               protocol: TCP
+            - name: ssh
+              containerPort: 22
+              protocol: TCP
             - name: turn-udp
               containerPort: 3478
               protocol: UDP