feat(spark): add staging overlay, scale down prod

- spark-cluster/eu-central-1-staging: namespace nowchess-staging, ingress
  patched to spark-st.* / spark-history-st.* with TLS + cert-manager
- spark-analytics/eu-central-1-staging: namespace nowchess-staging, image
  pinned to 0.2.0, all CronJob + live-dashboard patches carried over
- eu-central-1/argo-apps: spark-cluster-staging + spark-analytics-staging
  ArgoCD apps pointing at new staging overlays
- spark-cluster/eu-central-1-prod: scale spark-master and spark-worker to 0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

spark-cluster/eu-central-1-prod/kustomization.yaml

@@ -3,3 +3,24 @@ kind: Kustomization
 namespace: nowchess
 resources:
   - ../base
+patches:
+  - patch: |-
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: spark-master
+      spec:
+        replicas: 0
+    target:
+      kind: Deployment
+      name: spark-master
+  - patch: |-
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: spark-worker
+      spec:
+        replicas: 0
+    target:
+      kind: Deployment
+      name: spark-worker

spark-cluster/eu-central-1-staging/kustomization.yaml

@@ -0,0 +1,62 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: nowchess-staging
+resources:
+  - ../base
+patches:
+  - patch: |-
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: spark-master-ingress
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          nginx.ingress.kubernetes.io/ssl-redirect: "true"
+          nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+      spec:
+        rules:
+          - host: spark-st.nowchess.janis-eccarius.de
+            http:
+              paths:
+                - path: /
+                  pathType: Prefix
+                  backend:
+                    service:
+                      name: spark-master
+                      port:
+                        number: 8080
+        tls:
+          - hosts:
+              - spark-st.nowchess.janis-eccarius.de
+            secretName: spark-cluster-staging-cert
+    target:
+      kind: Ingress
+      name: spark-master-ingress
+  - patch: |-
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: spark-history-ingress
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          nginx.ingress.kubernetes.io/ssl-redirect: "true"
+          nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+      spec:
+        rules:
+          - host: spark-history-st.nowchess.janis-eccarius.de
+            http:
+              paths:
+                - path: /
+                  pathType: Prefix
+                  backend:
+                    service:
+                      name: spark-history-server-svc
+                      port:
+                        number: 18080
+        tls:
+          - hosts:
+              - spark-history-st.nowchess.janis-eccarius.de
+            secretName: spark-history-staging-cert
+    target:
+      kind: Ingress
+      name: spark-history-ingress