feat: add Kubernetes deployment support with Helm chart

Add health endpoints (/healthz, /readyz), graceful shutdown with
SIGTERM/SIGINT handling, multi-stage Dockerfile with distroless
runtime, and a full Helm chart with security-hardened defaults.

cmd/heatguard/main.go

@@ -1,10 +1,15 @@
 package main
 
 import (
+	"context"
 	"flag"
 	"fmt"
 	"log"
+	"net/http"
 	"os"
+	"os/signal"
+	"syscall"
+	"time"
 
 	"github.com/cnachtigall/heatwave-autopilot/internal/config"
 	"github.com/cnachtigall/heatwave-autopilot/internal/server"
@@ -32,8 +37,30 @@ func main() {
 	}
 
 	addr := fmt.Sprintf(":%d", *port)
-	log.Printf("HeatGuard listening on http://localhost%s", addr)
-	if err := srv.ListenAndServe(addr); err != nil {
-		log.Fatal(err)
+	httpServer := &http.Server{
+		Addr:    addr,
+		Handler: srv.Handler(),
 	}
+
+	// Graceful shutdown on SIGTERM/SIGINT
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+	defer stop()
+
+	go func() {
+		log.Printf("HeatGuard listening on http://localhost%s", addr)
+		if err := httpServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			log.Fatalf("listen: %v", err)
+		}
+	}()
+
+	<-ctx.Done()
+	log.Println("Shutting down...")
+
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	if err := httpServer.Shutdown(shutdownCtx); err != nil {
+		log.Fatalf("shutdown: %v", err)
+	}
+	log.Println("Shutdown complete")
 }