deploy kuma-glpi-bridge on pfv-k8s (NodePort 30801)

Incident pipeline: Kuma webhook -> GLPI ticket. Digest-pinned image,
imperative Secret glpi-creds (not in git), non-root/read-only pod.

CR: https://cmdb.knownelement.com/front/change.form.php?id=22
Ticket: https://projects.knownelement.com/issues/824

clusters/pfv-k8s/apps/kuma-glpi-bridge/deployment.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kuma-glpi-bridge
+  namespace: kuma-glpi-bridge
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: kuma-glpi-bridge}
+  template:
+    metadata:
+      labels: {app: kuma-glpi-bridge}
+    spec:
+      containers:
+        - name: bridge
+          image: git.knownelement.com/knel/kuma-glpi-bridge@sha256:9810ba15517079df99d8921bbe6d48380898adbc8f9185865b74b44f9c234616
+          ports: [{containerPort: 8080}]
+          envFrom: [{secretRef: {name: glpi-creds}}]
+          resources:
+            requests: {cpu: 10m, memory: 16Mi}
+            limits: {memory: 64Mi}
+          livenessProbe:
+            httpGet: {path: /healthz, port: 8080}
+            initialDelaySeconds: 5
+          securityContext:
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kuma-glpi-bridge
+  namespace: kuma-glpi-bridge
+spec:
+  type: NodePort
+  selector: {app: kuma-glpi-bridge}
+  ports:
+    - port: 8080
+      nodePort: 30801

clusters/pfv-k8s/apps/kuma-glpi-bridge/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - deployment.yaml

clusters/pfv-k8s/apps/kuma-glpi-bridge/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kuma-glpi-bridge

clusters/pfv-k8s/apps/kustomization.yaml

@@ -1,4 +1,5 @@
-# apps: tenant workloads per ADR-0001 tenant classes. Empty until #700 lands.
+# apps: platform/ops workloads + tenant workloads per ADR-0001 tenant classes.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources: []
+resources:
+  - kuma-glpi-bridge