chore(k8s): 适配生产部署

- ingress 只暴露 /api（前端静态文件由外部 Caddy 托管）
- deployment 填入正式域名 blog.zhaoxi.net.cn
- 真实 secret 移出 git 跟踪，改用 secret.example.yaml 模板

k8s/backend/secret.example.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: backend-secret
+  namespace: blog
+type: Opaque
+stringData:
+  database-url: "postgres://blog:CHANGE_ME@postgres:5432/blog"
+  jwt-secret: "CHANGE_ME_random_base64"
+  github-client-id: ""
+  github-client-secret: ""
+  github-admin-id: ""
+  s3-endpoint: ""
+  s3-region: "us-east-1"
+  s3-bucket: ""
+  s3-access-key: ""
+  s3-secret-key: ""
+  s3-public-url: ""