Add Kubernetes static-host publishing backend

[grinco]

Stacked on #3 (base = feat/configurable-backend) so this diff shows only the Kubernetes work. Merge after #3.

What

Adds a third publishing backend, selected with PAGEDROP_BACKEND=kubernetes: a self-hosted PageDrop host service on Kubernetes with viewing behind the operator's SSO proxy. Best HTML/CSS/JS fidelity (raw serving, no iframe sandbox) and clean internal URLs; no native Docs/Slides copies or Drive search. Built to the spec/plan in docs/lld/2026-07-04-pagedrop-kubernetes-backend-{design,plan}.md.

Topology — dumb server + smart adapter (mirrors the Apps Script split):

MCP ──Bearer token──▶ :8081 /api/*  (write/list/search/update)  ┐
                                                                ├─ pagedrop-host pod (PVC /data)
viewer ─SSO proxy──▶ :8080 /p/<id>, /  (rendered + index)       ┘

• Host service (src/host/, zero new deps — node:http/node:fs): two ports, atomic + exclusive-create storage on a PVC, path-traversal-guarded ids, crypto.timingSafeEqual bearer auth (fail-closed), HTML-escaped index page, update returns 404 (never creates), /healthz+/readyz.
• Adapter (src/adapters/k8s/): KubernetesPublisher implements Publisher (wraps HTML via src/core, composes /p/<id> view URLs), HostClient transport, config loader; wired into createPublisher().
• Packaging: Dockerfile (non-root, tsx) and a Helm chart (deploy/helm/pagedrop-host/) — Deployment replicas:1/Recreate over an RWO PVC, probes, Secret, two ingresses (SSO-fronted viewing + internal-only API), and a deny-by-default NetworkPolicy for the write API.

Reviews

Design was hardened via companion architectural review before implementation (Security model, atomic storage, deny-by-default network posture, escaping). Executed test-first, task-by-task, with per-unit verification and a final independent whole-branch review; its one Important finding (NetworkPolicy rendering allow-all with empty sources) and an actionable Minor (readiness probe checked nothing) are fixed and verified (5193f0b). A companion review of the full branch diff is also in flight.

Verification

• npx tsc --noEmit clean; npm test → 88/88.
• docker build + container /healthz smoke → OK.
• helm lint clean; helm template confirms deny-by-default (no 8081 allow-rule with empty sources; rule appears when a source is set) and readiness on the disk-checking api /readyz.
• The appsscript (default) and gcp backends are unchanged.

🤖 Generated with Claude Code

[grinco]

Updated with two fix rounds addressing the final whole-branch review and a companion architectural review:

• 5193f0b — NetworkPolicy deny-by-default for the write API (empty sources no longer render allow-all); readiness probe moved to the disk-checking api /readyz.
• a1201cd — view-port /readyz now also checks disk writability; NetworkPolicy can restrict the viewing port (8080) to configured sources (closing the in-cluster SSO-bypass gap), viewing ingress now defaults off (safe-by-default), and the host service handles SIGTERM/SIGINT for graceful shutdown.

Verification: 89/89 tests, tsc clean, helm lint/template confirm the deny-by-default and safe-default behaviors.

[grinco]

Added an onboarding-clarity commit: the guided Claude Code install block now defaults to the Apps Script backend (no Google Cloud account needed) with no backend-choice friction for first-timers, and the Backends section steers newcomers to appsscript (gcp/kubernetes labelled advanced). Defaults verified: createPublisher falls back to appsscript, and .mcp.json.example ships PAGEDROP_BACKEND=appsscript.