Matches the exact annotation pattern used for other tailnet services (Grafana, trade-dashboard, hermes-webui, etc.). This ensures the Tailscale operator correctly maps the exposed port after the 3000 change.
- containerPort: 3000 (matches Next.js default + Dockerfile ENV PORT=3000) - All probes (startup/liveness/readiness): path (Next.js serves root when ready) - Service targetPort: 3000 Fixes 'not ready' and 'can't reach it' (previous mismatch with 8000 + /api/health which didn't exist). Live manifests updated (source of truth).
- Scaffold trading-platform under apps/base/customer1/trading-platform/ - Add 4 microservice deployments: data-service, execute-service, news-service, dashboard - Add ConfigMaps with DB/Kafka/Redis connection configs - Add HTTPRoutes via Gateway API (external-http-gateway) - Add NetworkPolicies for inter-service and DB/Kafka/Redis egress - Add SOPS-encrypted secrets (age key) - Add Kafka (KRaft) and Redis infrastructure to hermes-db/ - Update root and staging kustomizations All containers: non-root, readOnlyRootFilesystem, resource limits, health probes Images: ghcr.io/sirius0xdev/trading-{service}:latest
