chore: initial infrastructure scaffold

Kustomize base + overlays for the full Sunbeam k3s stack:
- base/mesh      — Linkerd edge (crds + control-plane + viz)
- base/ingress   — custom Pingora edge proxy
- base/ory       — Kratos 0.60.1 + Hydra 0.60.1 + login-ui
- base/data      — CloudNativePG 0.27.1, Valkey 8, OpenSearch 2
- base/storage   — SeaweedFS master + volume + filer (S3 on :8333)
- base/lasuite   — Hive sync daemon + La Suite app placeholders
- base/media     — LiveKit livekit-server 1.9.0
- base/devtools  — Gitea 12.5.0 (external PG + Valkey)
overlays/local   — sslip.io domain, mkcert TLS, Lima hostPort
overlays/production — stub (TODOs for sunbeam.pt values)
scripts/         — local-up/down/certs/urls helpers
justfile         — up / down / certs / urls targets

base/media/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: media
+
+resources:
+  - namespace.yaml
+
+helmCharts:
+  # chart name is `livekit-server`, not `livekit-helm`
+  # helm repo add livekit https://helm.livekit.io
+  - name: livekit-server
+    repo: https://helm.livekit.io
+    version: "1.9.0"
+    releaseName: livekit
+    namespace: media
+    valuesFile: livekit-values.yaml

base/media/livekit-values.yaml

@@ -0,0 +1,37 @@
+# Base LiveKit Helm values (chart: livekit/livekit-server).
+# DOMAIN_SUFFIX is replaced by overlay patches.
+# API keys/secrets come from the livekit-keys Secret (loaded via extraEnv or config file).
+# Reference: https://github.com/livekit/livekit-helm/blob/master/server-sample.yaml
+
+livekit:
+  # LiveKit server config injected as config.yaml
+  port: 7880
+  log_level: info
+
+  rtc:
+    port_range_start: 49152
+    port_range_end:   49252
+    use_external_ip:  true
+
+  turn:
+    enabled:      true
+    domain:       meet.DOMAIN_SUFFIX
+    tls_port:     5349
+    udp_port:     3478
+    external_tls: true
+
+  redis:
+    # Valkey is protocol-compatible with Redis; LiveKit sees this as a Redis endpoint
+    address: valkey.data.svc.cluster.local:6379
+
+  # API keys are loaded from a Kubernetes Secret and mounted as env vars.
+  # keys:
+  #   <key>: <secret>  # set in overlay Secret, not here
+
+deployment:
+  resources:
+    limits:
+      memory: 128Mi
+    requests:
+      memory: 64Mi
+      cpu: 100m

base/media/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: media
+  annotations:
+    linkerd.io/inject: enabled