feat(nowchess): add Kargo project, Rollouts deployment, and secrets

- 9 Kargo Warehouses (one per microservice), staging + prod stages
- PromotionTask: clone GitOps, kustomize-set-image, Gitea PR, ArgoCD sync
- BlueGreen Rollouts for all 9 services with health probes and envFrom
- staging,deployed / production,deployed Quarkus multi-profile support
- CORS_ORIGINS and QUARKUS_PROFILE injected via nowchess-env-config ConfigMap
- Plain K8s Secrets with empty values in secrets/nowchess/ (staging, prod, kargo)
- ArgoCD Applications for kargo project, staging, and prod deployments

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

kargo-projects/nowchess/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ncs-project.yaml
+  - ncs-projectconfig.yaml
+  - ncs-warehouse.yaml
+  - ncs-stage.yaml
+  - ncs-promotion-template.yaml

kargo-projects/nowchess/ncs-project.yaml

@@ -0,0 +1,6 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Project
+metadata:
+  name: nowchess-kargo
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"

kargo-projects/nowchess/ncs-projectconfig.yaml

@@ -0,0 +1,9 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: ProjectConfig
+metadata:
+  name: nowchess-kargo
+spec:
+  promotionPolicies:
+    - autoPromotionEnabled: true
+      stageSelector:
+        name: regex:^staging$

kargo-projects/nowchess/ncs-promotion-template.yaml

@@ -0,0 +1,78 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: PromotionTask
+metadata:
+  name: nowchess-kargo-promotion-template
+  namespace: nowchess-kargo
+spec:
+  vars:
+    - name: repoUrl
+      value: https://git.janis-eccarius.de/NowChess/Gitops.git
+    - name: component
+      value: ${{ ctx.targetFreight.origin.name }}
+    - name: imageRepoUrl
+      value: 'ghcr.io/now-chess/now-chess-systems/${{ vars.component }}'
+    - name: branch
+      value: main
+    - name: imageTag
+      value: ${{ imageFrom(vars.imageRepoUrl).Tag }}
+  steps:
+    - uses: git-clone
+      config:
+        repoURL: ${{ vars.repoUrl }}
+        checkout:
+          - branch: ${{ vars.branch }}
+            path: ./work
+    - uses: kustomize-set-image
+      as: set-image
+      config:
+        path: ./work/nowchess/${{ vars.folder }}
+        images:
+          - image: ${{ vars.imageRepoUrl }}
+            tag: ${{ vars.imageTag }}
+    - uses: git-commit
+      as: commit
+      config:
+        path: ./work
+        message: "chore(kargo): update image tag ${{ vars.component }} to ${{ vars.imageTag }} on ${{ ctx.stage }}"
+    - uses: git-push
+      as: push
+      if: "${{ status('commit') != 'Skipped'}}"
+      config:
+        path: ./work
+        generateTargetBranch: true
+    - uses: git-open-pr
+      if: "${{ status('commit') != 'Skipped'}}"
+      as: open-pr
+      config:
+        repoURL: ${{ vars.repoUrl }}
+        provider: "gitea"
+        sourceBranch: ${{ task.outputs['push'].branch }}
+        targetBranch: ${{ vars.branch }}
+        title: "chore(kargo): update image tag ${{ vars.component }} to ${{ vars.imageTag }} on ${{ ctx.stage }}"
+        labels: ["kargo", "promotion"]
+    - uses: git-merge-pr
+      if: "${{ status('open-pr') != 'Skipped'}}"
+      as: merge-pr
+      config:
+        repoURL: ${{ vars.repoUrl }}
+        provider: "gitea"
+        prNumber: ${{ task.outputs['open-pr'].pr.id }}
+        wait: true
+    - uses: git-wait-for-pr
+      if: "${{ status('open-pr') != 'Skipped'}}"
+      as: wait-for-pr
+      config:
+        repoURL: ${{ vars.repoUrl }}
+        provider: "gitea"
+        prNumber: ${{ task.outputs['open-pr'].pr.id }}
+    - uses: argocd-update
+      as: argocd-update
+      config:
+        apps:
+          - name: ${{ vars.argocdName }}
+            sources:
+              - repoURL: git@git.janis-eccarius.de:NowChess/Gitops.git
+                kustomize:
+                  images:
+                    - repoURL: ${{ vars.imageRepoUrl }}
+                      tag: ${{ vars.imageTag }}

kargo-projects/nowchess/ncs-stage.yaml

@@ -0,0 +1,147 @@
+kind: Stage
+apiVersion: kargo.akuity.io/v1alpha1
+metadata:
+  name: staging
+  namespace: nowchess-kargo
+  annotations:
+    kargo.akuity.io/color: fuchsia
+spec:
+  vars:
+    - name: argocdName
+      value: nowchess-staging
+    - name: folder
+      value: eu-central-1-staging
+  requestedFreight:
+    - origin:
+        kind: Warehouse
+        name: account
+      sources:
+        direct: true
+    - origin:
+        kind: Warehouse
+        name: bot-platform
+      sources:
+        direct: true
+    - origin:
+        kind: Warehouse
+        name: coordinator
+      sources:
+        direct: true
+    - origin:
+        kind: Warehouse
+        name: core
+      sources:
+        direct: true
+    - origin:
+        kind: Warehouse
+        name: io
+      sources:
+        direct: true
+    - origin:
+        kind: Warehouse
+        name: official-bots
+      sources:
+        direct: true
+    - origin:
+        kind: Warehouse
+        name: rule
+      sources:
+        direct: true
+    - origin:
+        kind: Warehouse
+        name: store
+      sources:
+        direct: true
+    - origin:
+        kind: Warehouse
+        name: ws
+      sources:
+        direct: true
+  promotionTemplate:
+    spec:
+      steps:
+        - task:
+            name: nowchess-kargo-promotion-template
+---
+kind: Stage
+apiVersion: kargo.akuity.io/v1alpha1
+metadata:
+  name: prod
+  namespace: nowchess-kargo
+  annotations:
+    kargo.akuity.io/color: green
+spec:
+  vars:
+    - name: argocdName
+      value: nowchess
+    - name: folder
+      value: eu-central-1-prod
+  requestedFreight:
+    - origin:
+        kind: Warehouse
+        name: account
+      sources:
+        direct: false
+        stages:
+          - staging
+    - origin:
+        kind: Warehouse
+        name: bot-platform
+      sources:
+        direct: false
+        stages:
+          - staging
+    - origin:
+        kind: Warehouse
+        name: coordinator
+      sources:
+        direct: false
+        stages:
+          - staging
+    - origin:
+        kind: Warehouse
+        name: core
+      sources:
+        direct: false
+        stages:
+          - staging
+    - origin:
+        kind: Warehouse
+        name: io
+      sources:
+        direct: false
+        stages:
+          - staging
+    - origin:
+        kind: Warehouse
+        name: official-bots
+      sources:
+        direct: false
+        stages:
+          - staging
+    - origin:
+        kind: Warehouse
+        name: rule
+      sources:
+        direct: false
+        stages:
+          - staging
+    - origin:
+        kind: Warehouse
+        name: store
+      sources:
+        direct: false
+        stages:
+          - staging
+    - origin:
+        kind: Warehouse
+        name: ws
+      sources:
+        direct: false
+        stages:
+          - staging
+  promotionTemplate:
+    spec:
+      steps:
+        - task:
+            name: nowchess-kargo-promotion-template

kargo-projects/nowchess/ncs-warehouse.yaml

@@ -0,0 +1,134 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: account
+  namespace: nowchess-kargo
+spec:
+  freightCreationPolicy: Automatic
+  interval: 5m0s
+  subscriptions:
+    - image:
+        discoveryLimit: 20
+        imageSelectionStrategy: SemVer
+        repoURL: ghcr.io/now-chess/now-chess-systems/account
+        strictSemvers: true
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: bot-platform
+  namespace: nowchess-kargo
+spec:
+  freightCreationPolicy: Automatic
+  interval: 5m0s
+  subscriptions:
+    - image:
+        discoveryLimit: 20
+        imageSelectionStrategy: SemVer
+        repoURL: ghcr.io/now-chess/now-chess-systems/bot-platform
+        strictSemvers: true
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: coordinator
+  namespace: nowchess-kargo
+spec:
+  freightCreationPolicy: Automatic
+  interval: 5m0s
+  subscriptions:
+    - image:
+        discoveryLimit: 20
+        imageSelectionStrategy: SemVer
+        repoURL: ghcr.io/now-chess/now-chess-systems/coordinator
+        strictSemvers: true
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: core
+  namespace: nowchess-kargo
+spec:
+  freightCreationPolicy: Automatic
+  interval: 5m0s
+  subscriptions:
+    - image:
+        discoveryLimit: 20
+        imageSelectionStrategy: SemVer
+        repoURL: ghcr.io/now-chess/now-chess-systems/core
+        strictSemvers: true
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: io
+  namespace: nowchess-kargo
+spec:
+  freightCreationPolicy: Automatic
+  interval: 5m0s
+  subscriptions:
+    - image:
+        discoveryLimit: 20
+        imageSelectionStrategy: SemVer
+        repoURL: ghcr.io/now-chess/now-chess-systems/io
+        strictSemvers: true
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: official-bots
+  namespace: nowchess-kargo
+spec:
+  freightCreationPolicy: Automatic
+  interval: 5m0s
+  subscriptions:
+    - image:
+        discoveryLimit: 20
+        imageSelectionStrategy: SemVer
+        repoURL: ghcr.io/now-chess/now-chess-systems/official-bots
+        strictSemvers: true
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: rule
+  namespace: nowchess-kargo
+spec:
+  freightCreationPolicy: Automatic
+  interval: 5m0s
+  subscriptions:
+    - image:
+        discoveryLimit: 20
+        imageSelectionStrategy: SemVer
+        repoURL: ghcr.io/now-chess/now-chess-systems/rule
+        strictSemvers: true
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: store
+  namespace: nowchess-kargo
+spec:
+  freightCreationPolicy: Automatic
+  interval: 5m0s
+  subscriptions:
+    - image:
+        discoveryLimit: 20
+        imageSelectionStrategy: SemVer
+        repoURL: ghcr.io/now-chess/now-chess-systems/store
+        strictSemvers: true
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: ws
+  namespace: nowchess-kargo
+spec:
+  freightCreationPolicy: Automatic
+  interval: 5m0s
+  subscriptions:
+    - image:
+        discoveryLimit: 20
+        imageSelectionStrategy: SemVer
+        repoURL: ghcr.io/now-chess/now-chess-systems/ws
+        strictSemvers: true