feat(deploy): add dashboard production patch with dataplane token

The production kustomize overlay was missing a dashboard deployment
patch. The base dashboard.yaml only configures AUTH_SECRET and
AUTH_TRUST_HOST; in production the dashboard needs:

1. CONTROLPLANE_ADMIN_URL / DATAPLANE_ADMIN_URL — in-cluster service
   URLs instead of the code default (localhost).

2. DATAPLANE_BEARER_TOKEN — the dataplane admin uses a separate
   bearer token (nantian-gw-dataplane-admin-auth secret) that differs
   from the controlplane admin token. The dashboard BFF proxy needs
   this token to authenticate against dataplane /v1/summary and other
   admin endpoints.

Also wire all three existing patches (controlplane, dataplane, and now
dashboard) into the production kustomization.yaml patches list.
Previously these patches were not referenced in the kustomization.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: mahmut-Abi

deploy/kubernetes/overlays/production/kustomization.yaml

@@ -3,4 +3,9 @@ kind: Kustomization
 
 resources:
   - ../../base
-  - ../../addons/dataplane-hpa
+  - ../../addons/dataplane-hpa
+
+patches:
+  - path: patch-controlplane-deployment.yaml
+  - path: patch-dataplane-deployment.yaml
+  - path: patch-dashboard-deployment.yaml

deploy/kubernetes/overlays/production/patch-dashboard-deployment.yaml

@@ -0,0 +1,30 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nantian-gw-dashboard
+  namespace: nantian-gw
+spec:
+  template:
+    spec:
+      containers:
+        - name: dashboard
+          env:
+            - name: CONTROLPLANE_ADMIN_URL
+              value: "http://nantian-gw-controlplane-admin.nantian-gw.svc.cluster.local:18081"
+            - name: DATAPLANE_ADMIN_URL
+              value: "http://nantian-gw-dataplane-admin.nantian-gw.svc.cluster.local:19080"
+            # Inject the dataplane admin bearer token so the dashboard BFF can
+            # proxy to dataplane admin endpoints, which use a different token
+            # than the controlplane admin the dashboard session authenticates with.
+            - name: DATAPLANE_BEARER_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: nantian-gw-dataplane-admin-auth
+                  key: token
+          resources:
+            requests:
+              cpu: "100m"
+              memory: 128Mi
+            limits:
+              cpu: "500m"
+              memory: 256Mi