Initial commit — LoginMaster tenant deployment toolkit

Toolkit per deployare/aggiornare un tenant LoginMaster su qualsiasi Kubernetes
(EKS/AKS/DOKS/Scaleway/vSphere/...). Contiene:

- deploy.sh: bootstrap di un nuovo tenant (idempotente, re-run protection,
  storage class auto-rilevata, prompt separati api/admin tag, generazione
  segreti crittografici via openssl rand).
- update.sh: rolling update zero-downtime con tag api/admin separati, rollback
  hint via 'kubectl rollout undo', riapplicazione opzionale del ConfigMap.
- templates/: 8 manifest parametrici (envsubst): namespace, cert-manager TLS
  Mongo, NetworkPolicy intra-namespace, ConfigMap, MongoDB StatefulSet 3 repliche
  con TLS interno + initContainer per keyfile/PEM, tenant-api Deployment 2 repliche
  con CA validation, tenant-admin, ingress nginx + Let's Encrypt.

Sicurezza: TLS interno Mongo (cert-manager CA self-signed 10y), keyFile per
auth replica set, password client mai in argv, NetworkPolicy che isola il
tenant, pod Mongo non-root (uid 999) con initContainer come root per i file
runtime in tmpfs.

templates/02-networkpolicy.yaml

@@ -0,0 +1,71 @@
+# NetworkPolicy: isolamento del namespace tenant.
+# - mongodb-tenant: ingress solo dai pod tenant-api e dagli altri membri del replica set.
+# - tenant-api:     ingress solo dall'ingress controller (namespace 'ingress-nginx').
+# - tenant-admin:   ingress solo dall'ingress controller.
+# Egress: non vincolato (DNS, registry, SMTP, LOGINMASTER_API_URL devono restare raggiungibili).
+#
+# Nota: la namespace label 'kubernetes.io/metadata.name' è automatica dal K8s 1.22+.
+# Se l'ingress controller è installato in un namespace diverso, modificare il selector.
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: mongodb-tenant
+  namespace: ${NAMESPACE}
+spec:
+  podSelector:
+    matchLabels:
+      app: mongodb-tenant
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: mongodb-tenant
+        - podSelector:
+            matchLabels:
+              app: tenant-api
+      ports:
+        - protocol: TCP
+          port: 27017
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: tenant-api
+  namespace: ${NAMESPACE}
+spec:
+  podSelector:
+    matchLabels:
+      app: tenant-api
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+      ports:
+        - protocol: TCP
+          port: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: tenant-admin
+  namespace: ${NAMESPACE}
+spec:
+  podSelector:
+    matchLabels:
+      app: tenant-admin
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+      ports:
+        - protocol: TCP
+          port: 80