Fix Kubernetes manifest bugs, dedupe drifted files, harden security

- Rebuild manifests/doormile/miletruth.yaml (was corrupted since the
  initial commit - contained pasted AI/terminal output, truncated env
  var names/values, duplicate keys). Rebuilt from the confirmed-live
  config, secrets sourced via a Secret instead of plaintext values.
- Lock down the Kubernetes Dashboard: remove --enable-skip-login /
  --enable-insecure-login / --insecure-port=9090, remove the extra
  cluster-admin binding on the dashboard's own ServiceAccount, remove
  the now-dead insecure NodePort Service. Token-based login via the
  existing admin-user ServiceAccount is unaffected.
- Fix the duplicate `backendRefs` key under the same HTTPRoute rule in
  alaska.yaml (invalid/redundant YAML).
- Delete 6 redundant duplicate manifests (fiesta-sts/svc,
  atlantis-sts/svc, jupiter-sts/svc) that were partial, stale subsets
  of nearle-fiesta/atlantis/jupiter.yaml - one pair disagreed on the
  fiesta image tag entirely (v1.3.50 vs v1.3.67, neither of which
  matched what's actually live).
- Reconcile nearle-fiesta.yaml and nearle-jupiter.yaml image tags to
  the confirmed-live versions (v1.3.78 / v2.7.55).
- Add allowPrivilegeEscalation:false + drop-all-capabilities to
  fiesta/atlantis/jupiter/titan/ariane and the 5 specialized core
  workers, which previously ran with no securityContext at all.
- Add terminationGracePeriodSeconds:45 to the worker StatefulSets so
  Kubernetes gives the new graceful-shutdown drain (see worker.py
  changes) enough time before SIGKILL.

manifests/core/workers.yaml

@@ -22,6 +22,7 @@ spec:
         prometheus.io/port: "9090"
         prometheus.io/path: "/metrics"
     spec:
+      terminationGracePeriodSeconds: 45
       tolerations:
       - key: dedicated
         operator: Equal
@@ -58,6 +59,11 @@ spec:
       - name: worker
         image: workolik360/nats-worker:v1.1.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         command: ["python3", "-u", "/scripts/worker.py"]
         volumeMounts:
         - name: worker-script-vol
@@ -132,6 +138,7 @@ spec:
         prometheus.io/port: "9090"
         prometheus.io/path: "/metrics"
     spec:
+      terminationGracePeriodSeconds: 45
       tolerations:
       - key: dedicated
         operator: Equal
@@ -168,6 +175,11 @@ spec:
       - name: worker
         image: workolik360/nats-worker:v1.1.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         command: ["python3", "-u", "/scripts/worker.py"]
         volumeMounts:
         - name: worker-script-vol
@@ -236,6 +248,7 @@ spec:
         prometheus.io/port: "9090"
         prometheus.io/path: "/metrics"
     spec:
+      terminationGracePeriodSeconds: 45
       tolerations:
       - key: dedicated
         operator: Equal
@@ -272,6 +285,11 @@ spec:
       - name: worker
         image: workolik360/nats-worker:v1.1.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         command: ["python3", "-u", "/scripts/worker.py"]
         volumeMounts:
         - name: worker-script-vol
@@ -346,6 +364,7 @@ spec:
         prometheus.io/port: "9090"
         prometheus.io/path: "/metrics"
     spec:
+      terminationGracePeriodSeconds: 45
       tolerations:
       - key: dedicated
         operator: Equal
@@ -382,6 +401,11 @@ spec:
       - name: worker
         image: workolik360/nats-worker:v1.1.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         command: ["python3", "-u", "/scripts/worker.py"]
         volumeMounts:
         - name: worker-script-vol
@@ -456,6 +480,7 @@ spec:
         prometheus.io/port: "9090"
         prometheus.io/path: "/metrics"
     spec:
+      terminationGracePeriodSeconds: 45
       tolerations:
       - key: dedicated
         operator: Equal
@@ -492,6 +517,11 @@ spec:
       - name: worker
         image: workolik360/nats-worker:v1.1.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
         command: ["python3", "-u", "/scripts/worker.py"]
         volumeMounts:
         - name: worker-script-vol