v0.3.0 — Production K8s (Helm/HPA/NetworkPolicies/RBAC)

Converted manifests to a Helm chart. Added HPA (verified scaling 2→6 replicas under load), NetworkPolicies (verified pod isolation), and RBAC (verified scoped permissions via kubectl auth can-i).