Fix deployment tooling: shell scripts and Terraform

Terraform (validated with the real terraform CLI - was never actually
run against this cluster, no state file existed):
- Delete main.tf: it declared a duplicate kubernetes_namespace.core
  (also in namespaces.tf) and a duplicate provider "kubernetes" block
  (also in providers.tf), both hard errors that would fail
  `terraform plan` immediately.
- Fix workloads.tf references to 6 files deleted in the manifest
  cleanup (jupiter-sts/svc, atlantis-sts/svc, fiesta-sts/svc) - now
  points at the canonical nearle-jupiter/atlantis/fiesta.yaml.
- Fix every kubernetes_manifest resource: they fed multi-document
  YAML (multiple '---'-separated docs per file) straight into
  yamldecode(), which only parses a single document. Rewrote using a
  split-on-'---' + for_each pattern, confirmed safe first by checking
  separator counts exactly match document counts for every affected
  file (no embedded '---' inside any script/config content).
- Add the doormile namespace; rename kubernetes_namespace to
  kubernetes_namespace_v1 (fixes a deprecation warning).
- `terraform validate` now passes clean.

Shell scripts:
- deploy-nearle-stack.sh only applied 4 of the ~13 files in
  manifests/nearle/ - missing the ConfigMap/Secrets fiesta/jupiter/
  titan/ariane need via envFrom, the fiesta gateway script ConfigMap,
  atlantis entirely, and the Gateway/ReferenceGrant/jupiter-cors-proxy
  resources. Now applies every file (verified by diffing the
  directory listing against the script).
- Added deploy-doormile.sh and deploy-ingress.sh - nothing previously
  applied ingress-unified.yaml or traefik-middlewares.yaml at all.
- Rewrote deploy.sh as an orchestrator calling all of the above in
  order (previously referenced a manifests/namespace.yaml layout that
  hasn't existed since before this repo's initial commit).
- Rewrote check-k8s-status.sh to check the real namespaces
  (core/nearle/alaska/doormile/kubernetes-dashboard) instead of a
  'nats-backend' namespace that never existed in this repo.
- Fixed a `cd` bug in setup-jetstream.sh that made it change into
  shfiles/ and then look for scripts/setup_jetstream.py there (a
  child directory that doesn't exist) - it could never have found its
  own target file. Now pulls NATS credentials from the live
  nats-credentials Secret instead of a third hardcoded copy.

Python scripts:
- sync_manifests.py had hardcoded Windows paths (e:\nats\kubernetes\...)
  - replaced with paths relative to the script's own location so it
  actually runs here (or anywhere). Verified by running it.
- setup_jetstream.py created durable consumers under different names
  than worker.py computes at runtime ({NATS_CONSUMER}_{subject}), so
  its max_deliver/ack_wait settings never actually reached the
  consumers workers bind to. Naming now derived with the same logic
  worker.py uses - verified all 10 derived names match workers.yaml
  exactly.
- purge-old-messages.py had hardcoded NATS credentials with no env
  var override at all - fixed to match the pattern used everywhere
  else.

shfiles/deploy.sh

@@ -1,10 +1,12 @@
 #!/bin/bash
-# Kubernetes Deployment Script for 3-Node Cluster
-# Usage: ./deploy.sh
+# Deploy the full stack to Kubernetes (core, nearle, alaska, doormile, ingress)
+# Usage: ./shfiles/deploy.sh   (run from the repo root, or anywhere - it cd's there itself)
 
-set -e
+set -euo pipefail
 
-echo "🚀 Deploying to Kubernetes (3-Node Cluster)..."
+cd "$(dirname "$0")/.."
+
+echo "🚀 Deploying full stack..."
 
 # Check if kubectl is available
 if ! command -v kubectl &> /dev/null; then
@@ -23,46 +25,29 @@ kubectl cluster-info || {
 NODE_COUNT=$(kubectl get nodes --no-headers | wc -l)
 echo "📊 Cluster has $NODE_COUNT node(s)"
 
-# Apply namespace
-echo "📦 Creating namespace..."
-kubectl apply -f manifests/namespace.yaml
-
-# Apply secrets
-echo "🔐 Creating secrets..."
-kubectl apply -f manifests/secrets.yaml
-
-# Apply FastAPI
-echo "🐍 Deploying FastAPI backend..."
-kubectl apply -f manifests/fastapi-deployment.yaml
-kubectl apply -f manifests/fastapi-service.yaml
-kubectl apply -f manifests/fastapi-hpa.yaml
-
-# Apply Workers
-echo "👷 Deploying NATS workers..."
-kubectl apply -f manifests/worker-deployment.yaml
-kubectl apply -f manifests/worker-hpa.yaml
-
-# Apply Gateway (optional - only if Gateway API is installed)
-read -p "Deploy Gateway API? (requires Gateway API controller) [y/N] " -n 1 -r
-echo
-if [[ $REPLY =~ ^[Yy]$ ]]; then
-    echo "🚪 Deploying Gateway API..."
-    kubectl apply -f manifests/gateway.yaml
-fi
+echo ""
+echo "===== Core stack (NATS workers) ====="
+bash shfiles/deploy-core-stack.sh
 
 echo ""
-echo "✅ Deployment complete!"
+echo "===== Nearle stack (jupiter, titan, fiesta, ariane, atlantis) ====="
+bash shfiles/deploy-nearle-stack.sh
+
+echo ""
+echo "===== Alaska stack (deliveries gateway + dashboard) ====="
+bash shfiles/deploy-alaska.sh
+
+echo ""
+echo "===== Doormile stack ====="
+bash shfiles/deploy-doormile.sh
+
+echo ""
+echo "===== Ingress & Traefik middlewares ====="
+bash shfiles/deploy-ingress.sh
+
+echo ""
+echo "✅ Full deployment complete!"
 echo ""
 echo "📋 Check status:"
-echo "   kubectl get pods -n nats-backend -o wide"
-echo "   kubectl get nodes"
-echo "   kubectl get hpa -n nats-backend"
+echo "   bash shfiles/check-k8s-status.sh"
 echo ""
-echo "📊 View pod distribution across nodes:"
-echo "   kubectl get pods -n nats-backend -o wide | grep -E 'NAME|fastapi|worker'"
-echo ""
-echo "📝 View logs:"
-echo "   kubectl logs -f deployment/fastapi-backend -n nats-backend"
-echo "   kubectl logs -f deployment/nats-worker -n nats-backend"
-echo ""
-