Fix Kubernetes manifest bugs, dedupe drifted files, harden security

- Rebuild manifests/doormile/miletruth.yaml (was corrupted since the
  initial commit - contained pasted AI/terminal output, truncated env
  var names/values, duplicate keys). Rebuilt from the confirmed-live
  config, secrets sourced via a Secret instead of plaintext values.
- Lock down the Kubernetes Dashboard: remove --enable-skip-login /
  --enable-insecure-login / --insecure-port=9090, remove the extra
  cluster-admin binding on the dashboard's own ServiceAccount, remove
  the now-dead insecure NodePort Service. Token-based login via the
  existing admin-user ServiceAccount is unaffected.
- Fix the duplicate `backendRefs` key under the same HTTPRoute rule in
  alaska.yaml (invalid/redundant YAML).
- Delete 6 redundant duplicate manifests (fiesta-sts/svc,
  atlantis-sts/svc, jupiter-sts/svc) that were partial, stale subsets
  of nearle-fiesta/atlantis/jupiter.yaml - one pair disagreed on the
  fiesta image tag entirely (v1.3.50 vs v1.3.67, neither of which
  matched what's actually live).
- Reconcile nearle-fiesta.yaml and nearle-jupiter.yaml image tags to
  the confirmed-live versions (v1.3.78 / v2.7.55).
- Add allowPrivilegeEscalation:false + drop-all-capabilities to
  fiesta/atlantis/jupiter/titan/ariane and the 5 specialized core
  workers, which previously ran with no securityContext at all.
- Add terminationGracePeriodSeconds:45 to the worker StatefulSets so
  Kubernetes gives the new graceful-shutdown drain (see worker.py
  changes) enough time before SIGKILL.

manifests/alaska/alaska.yaml

@@ -330,10 +330,6 @@ spec:
     - name: deliveries-service
       port: 8000
       weight: 100
-    backendRefs:
-    - name: deliveries-service
-      port: 8000
-      weight: 100
   - matches:
     - path:
         type: PathPrefix

manifests/alaska/k8s-dashboard.yaml

@@ -34,19 +34,6 @@ metadata:
     kubernetes.io/service-account.name: "admin-user"
 type: kubernetes.io/service-account-token
 ---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kubernetes-dashboard-admin
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-- kind: ServiceAccount
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -75,9 +62,6 @@ spec:
         args:
           - --auto-generate-certificates
           - --namespace=kubernetes-dashboard
-          - --enable-skip-login
-          - --enable-insecure-login
-          - --insecure-port=9090
         volumeMounts:
         - name: kubernetes-dashboard-certs
           mountPath: /certs
@@ -135,10 +119,6 @@ spec:
     targetPort: 8443
     protocol: TCP
     name: https
-  - port: 9090
-    targetPort: 9090
-    protocol: TCP
-    name: http
   selector:
     k8s-app: kubernetes-dashboard
 ---
@@ -307,22 +287,3 @@ spec:
     targetPort: 8083
     nodePort: 30826
     protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: dashboard-loadbalancer
-  namespace: kubernetes-dashboard
-  labels:
-    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/component: loadbalancer
-spec:
-  type: NodePort
-  selector:
-    k8s-app: kubernetes-dashboard
-  ports:
-  - name: http
-    port: 9090
-    targetPort: 9090  # Dashboard HTTP port
-    nodePort: 30827   # Fixed NodePort for nginx proxy
-    protocol: TCP