WP-12: Kubernetes overview and workload actions

kube-rs gateway (nodes, namespaces, deployments/statefulsets/daemonsets with
images, PVCs; rollout restart, scale, set image via patches) using the
microk8s kubeconfig by default, fake gateway for dev, /api/cluster routes,
Kubernetes page with node cards, workload table with admin actions and PVC
list. Also implements the streaming command runner that WP-11 relied on.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/api/src/config.rs

@@ -9,6 +9,8 @@ pub struct Config {
     pub master_key: String,
     /// Use fake host adapters (dev machines without apt/kubectl).
     pub fake_host: bool,
+    /// Path to a kubeconfig; None infers. Defaults to the microk8s client config if present.
+    pub kubeconfig: Option<String>,
     pub bind: SocketAddr,
     pub bootstrap_admin: Option<(String, String)>,
     pub cookie_secure: bool,
@@ -32,6 +34,12 @@ impl Config {
             jwt_secret,
             master_key,
             fake_host: env("FAKE_HOST").is_some_and(|v| v == "true" || v == "1"),
+            kubeconfig: env("KUBECONFIG").or_else(|| {
+                let microk8s = "/var/snap/microk8s/current/credentials/client.config";
+                std::path::Path::new(microk8s)
+                    .exists()
+                    .then(|| microk8s.to_string())
+            }),
             bind: env("BIND")
                 .unwrap_or_else(|| "127.0.0.1:8080".into())
                 .parse()?,