- Replace Ingress template with HTTPRoute (gateway.networking.k8s.io/v1)
- Add cert-manager.io/cluster-issuer annotation for auto TLS
- Add imagePullSecrets, env, envFrom support to deployment
- Update NOTES.txt with ITSH Cloud DNS records
Add health endpoints (/healthz, /readyz), graceful shutdown with
SIGTERM/SIGINT handling, multi-stage Dockerfile with distroless
runtime, and a full Helm chart with security-hardened defaults.
