Prod: standalone Deployment/Service bootstrap files; drop namespace create

- Add server-ce/k8s/verso-prod-data.yaml (Mongo + Redis) and
  verso-prod-app.yaml (Verso app), mirroring the workflow so the verso
  namespace can be bootstrapped/validated by hand.
- Drop 'kubectl create namespace verso' from the prod workflow (namespace is
  pre-created), so the runner only needs namespaced rights in verso, matching
  the test namespace.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy-verso-prod.yml

@@ -133,15 +133,14 @@ jobs:
           kubectl -n ci logs job/verso-buildkit-prod -c prepare || true
           kubectl -n ci logs job/verso-buildkit-prod -c buildkit || true
 
-      - name: Ensure namespace + persistent data services (never deleted)
+      - name: Ensure data services (Mongo + Redis, never deleted)
         run: |
-          kubectl create namespace verso --dry-run=client -o yaml | kubectl apply -f -
-
           # Mongo/Redis. Applied idempotently — this step must never delete
-          # these, so project data survives every deploy. The PVCs themselves
-          # are provisioned out of band (server-ce/k8s/verso-prod-pvcs.yaml) so
-          # the storageClass is under your control; this step assumes
-          # mongo-data / redis-data / verso-data already exist.
+          # these, so project data survives every deploy. The namespace and the
+          # PVCs (server-ce/k8s/verso-prod-pvcs.yaml) are provisioned out of
+          # band, so the runner only needs namespaced rights in `verso` (like
+          # `test`). This step assumes the namespace and the
+          # mongo-data / redis-data / verso-data PVCs already exist.
           cat <<'EOF' | kubectl apply -f -
           apiVersion: apps/v1
           kind: Deployment