feat: add kustomize deployment bundle for Backstage

Add the config/ tree that is published as the backstage-kustomize OCI
bundle and consumed by the e2e gate.

Key changes:
- config/base: namespace, service account, ClusterIP service on 7007, and
  a Deployment running the backend image with readiness/liveness probes on
  the new-backend health endpoints (/.backstage/health/v1/readiness and
  /.backstage/health/v1/liveness). The kustomization carries an images
  entry for ghcr.io/datum-cloud/backstage so the bundle publisher can pin
  the built tag.
- config/test: e2e overlay that boots Backstage without GCP secrets or
  SSO. Adds an ephemeral postgres:16-alpine, an app-config.e2e.yaml
  ConfigMap (guest auth, default auth policy disabled, pg database, github
  integrations/providers removed, a small static example catalog), and a
  Deployment patch wiring the DB env and config mount. The image is pinned
  to backstage:e2e so kind uses the locally loaded image.

Claude-Session: https://claude.ai/code/session_01NMSkwUcaTmZr7S5XmV2aFG

Author: scotwells

config/base/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backstage
+  namespace: backstage
+  labels:
+    app.kubernetes.io/name: backstage
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: backstage
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: backstage
+    spec:
+      serviceAccountName: backstage
+      containers:
+        - name: backstage
+          image: ghcr.io/datum-cloud/backstage
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 7007
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /.backstage/health/v1/readiness
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /.backstage/health/v1/liveness
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 500m
+              memory: 512Mi
+            limits:
+              memory: 1Gi

config/base/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - service.yaml
+  - deployment.yaml
+
+images:
+  - name: ghcr.io/datum-cloud/backstage

config/base/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: backstage

config/base/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: backstage
+  namespace: backstage
+  labels:
+    app.kubernetes.io/name: backstage
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: backstage
+  ports:
+    - name: http
+      port: 7007
+      targetPort: http
+      protocol: TCP

config/base/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backstage
+  namespace: backstage

config/test/app-config-e2e.yaml

@@ -0,0 +1,47 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: backstage-app-config-e2e
+  namespace: backstage
+data:
+  app-config.e2e.yaml: |
+    app:
+      baseUrl: http://localhost:7007
+
+    backend:
+      baseUrl: http://localhost:7007
+      listen:
+        port: 7007
+        host: 0.0.0.0
+      csp:
+        connect-src: ["'self'", 'http:', 'https:']
+      cors:
+        origin: http://localhost:7007
+        methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
+        credentials: true
+      database:
+        client: pg
+        connection:
+          host: ${POSTGRES_HOST}
+          port: ${POSTGRES_PORT}
+          user: ${POSTGRES_USER}
+          password: ${POSTGRES_PASSWORD}
+      auth:
+        dangerouslyDisableDefaultAuthPolicy: true
+
+    auth:
+      providers:
+        guest:
+          dangerouslyAllowOutsideDevelopment: true
+
+    integrations: {}
+
+    catalog:
+      providers: {}
+      locations:
+        - type: file
+          target: /app/examples/entities.yaml
+        - type: file
+          target: /app/examples/org.yaml
+          rules:
+            - allow: [User, Group]

config/test/deployment-patch.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backstage
+  namespace: backstage
+spec:
+  template:
+    spec:
+      containers:
+        - name: backstage
+          args:
+            - "node"
+            - "packages/backend"
+            - "--config"
+            - "app-config.yaml"
+            - "--config"
+            - "/etc/backstage/app-config.e2e.yaml"
+          env:
+            - name: POSTGRES_HOST
+              value: postgres
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: backstage-postgres
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: backstage-postgres
+                  key: POSTGRES_PASSWORD
+          volumeMounts:
+            - name: app-config-e2e
+              mountPath: /etc/backstage
+              readOnly: true
+      volumes:
+        - name: app-config-e2e
+          configMap:
+            name: backstage-app-config-e2e

config/test/kustomization.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: backstage
+
+resources:
+  - ../base
+  - postgres-secret.yaml
+  - postgres-deployment.yaml
+  - postgres-service.yaml
+  - app-config-e2e.yaml
+
+images:
+  - name: ghcr.io/datum-cloud/backstage
+    newName: backstage
+    newTag: e2e
+
+patches:
+  - path: deployment-patch.yaml
+    target:
+      kind: Deployment
+      name: backstage

config/test/postgres-deployment.yaml

@@ -0,0 +1,44 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  namespace: backstage
+  labels:
+    app.kubernetes.io/name: postgres
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: postgres
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16-alpine
+          ports:
+            - name: postgres
+              containerPort: 5432
+          envFrom:
+            - secretRef:
+                name: backstage-postgres
+          env:
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "backstage"]
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+      volumes:
+        - name: data
+          emptyDir: {}

config/test/postgres-secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: backstage-postgres
+  namespace: backstage
+type: Opaque
+stringData:
+  POSTGRES_USER: backstage
+  POSTGRES_PASSWORD: backstage
+  POSTGRES_DB: backstage