chore: sync server-local config drift (catalogue/S3 env, kustomize deploy scripts)

Brings /opt/kubernetes in line with config that was applied directly
on the server: catalogue DB and S3 credentials/config in
nearle-config.yaml and nearle-app-secrets.yaml, and deploy scripts
switched to kubectl apply -k against the kustomize manifests. Also
dedupes USE_S3/S3_ENDPOINT/S3_BUCKET/S3_REGION which were listed
twice in nearle-config.yaml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

manifests/nearle/nearle-app-secrets.yaml

@@ -7,17 +7,14 @@ metadata:
     app: fiesta
 type: Opaque
 stringData:
-  # The IP of your BigRock Server
   DATABASE_HOST: "66.116.207.225"
   DB_HOST: "66.116.207.225"
-
-  # The user we confirmed works
   DATABASE_USERNAME: "admin"
   DB_USER: "admin"
-  
-  # The password we confirmed works
   DATABASE_PASSWORD: "Package@123#"
   DB_PASSWORD: "Package@123#"
-  
-  # The rest...
   JWT_SECRET_KEY: "nearle"
+  CATALOGUE_DB_USER: "admin"
+  CATALOGUE_DB_PASSWORD: "'Package@321#'"
+  S3_ACCESS_KEY: "DO801G8Q8JAZKF49U3WJ"
+  S3_SECRET_KEY: "lBQExYfkVqH+ybmGVmQH5MkThBbrIohA/VQLgcPUvug"

manifests/nearle/nearle-config.yaml

@@ -8,10 +8,8 @@ metadata:
 data:
   NATS_URL: "nats://66.116.226.161:4222"
   LOG_LEVEL: "info"
-  # The stream is set to ORDERS as per your request
   NATS_STREAM: "ORDERS"
-  # Base subject pattern - the app likely appends the path to this or uses it as a listener filter
-  NATS_SUBJECT: "api.>" 
+  NATS_SUBJECT: "api.>"
   ALLOWED_ORIGINS: "*"
   ENV: "production"
   DATABASE_NAME: "nearledb"
@@ -21,3 +19,10 @@ data:
   DATABASE_SERVER_HOST: "66.116.207.225"
   DB_HOST: "66.116.207.225"
   USER_CONTEXT_KEY: "nearle"
+  CATALOGUE_DB_HOST: "31.97.228.132"
+  CATALOGUE_DB_PORT: "6054"
+  CATALOGUE_DB_NAME: "pgvector"
+  USE_S3: "true"
+  S3_ENDPOINT: "https://nearle.sgp1.digitaloceanspaces.com"
+  S3_BUCKET: "nearle"
+  S3_REGION: "sgp1"