deploy(wallet-web): lux overlay tag-pin fix + plain-manifest fallback

Pin the image tag the way a custom CR requires: the lux.cloud/v1 Service CR
holds the tag in structured spec.image.tag, which the kustomize images:
transformer does NOT reach — so it is pinned via a JSON patch (was silently
staying at :latest). Set to the built sha dc08a6af0.

Add fallback.yaml: equivalent plain manifests (Deployment + Service + Ingress +
cert-manager Certificate via ingress-shim / letsencrypt-prod DNS-01). lux-k8s
runs lux-operator scaled to 0, so services.lux.cloud does not reconcile; these
reproduce exactly what it would generate, letting wallet.lux.network go live
without scaling the operator (which would touch other lux-mainnet CRs/luxd).
Follows the proven safe.lux.network ingress pattern (class ingress, DNS-01).

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

apps/web/k8s/overlays/lux/fallback.yaml

@@ -0,0 +1,130 @@
+# wallet-web — LUX brand, PLAIN-MANIFEST deploy (operational fallback).
+#
+# The declarative desired state is the lux.cloud/v1 Service CR (k8s/base/
+# wallet-web.yaml + this overlay's kustomization.yaml), reconciled by
+# lux-system/lux-operator. On lux-k8s that operator is currently scaled to 0,
+# so the CR does not materialize. These manifests reproduce EXACTLY what the
+# operator would generate — Deployment + Service + Ingress (+ cert-manager
+# auto-issued Certificate) — so wallet.lux.network goes live WITHOUT scaling the
+# operator (which would risk reconciling other drifted CRs / the luxd validators
+# that also live in lux-mainnet).
+#
+# Ingress + TLS follow the exact proven lux-k8s pattern (cf. safe.lux.network):
+# ingressClassName `ingress` (hanzoai/ingress — NOT nginx/caddy) + the
+# cert-manager.io/cluster-issuer annotation, which the ingress-shim turns into a
+# Certificate issued by letsencrypt-prod over DNS-01 (Cloudflare) — so the cert
+# issues even before DNS is repointed.
+#
+# The wallet-web-brand ConfigMap (the Lux brand.json mounted at
+# /public/brand.json) is generated by this overlay's configMapGenerator.
+#
+#   kubectl --context do-sfo3-lux-k8s apply -f fallback.yaml
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wallet-web
+  namespace: lux-mainnet
+  labels:
+    app: wallet-web
+    component: web
+    brand: lux
+    app.kubernetes.io/part-of: wallet-web
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: wallet-web
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: wallet-web
+        component: web
+        brand: lux
+        app.kubernetes.io/part-of: wallet-web
+    spec:
+      imagePullSecrets:
+        - name: ghcr-luxfi
+      containers:
+        - name: web
+          image: ghcr.io/luxfi/wallet-web:28974b175
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 3000
+          volumeMounts:
+            - name: brand
+              mountPath: /public/brand.json
+              subPath: brand.json
+              readOnly: true
+          resources:
+            requests:
+              cpu: "50m"
+              memory: "64Mi"
+            limits:
+              cpu: "250m"
+              memory: "256Mi"
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 15
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 3
+            periodSeconds: 5
+      volumes:
+        - name: brand
+          configMap:
+            name: wallet-web-brand
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wallet-web
+  namespace: lux-mainnet
+  labels:
+    app: wallet-web
+    brand: lux
+    app.kubernetes.io/part-of: wallet-web
+spec:
+  selector:
+    app: wallet-web
+  ports:
+    - name: http
+      port: 80
+      targetPort: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wallet-web
+  namespace: lux-mainnet
+  labels:
+    app: wallet-web
+    brand: lux
+    app.kubernetes.io/part-of: wallet-web
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: ingress
+  rules:
+    - host: wallet.lux.network
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wallet-web
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - wallet.lux.network
+      secretName: wallet-web-tls

apps/web/k8s/overlays/lux/kustomization.yaml

@@ -20,8 +20,7 @@ labels:
 # Brand.json → ConfigMap. Key `brand.json` = the mount subPath. The hash suffix
 # is disabled because the volume reference lives in a custom (lux.cloud/v1
 # Service) CR that kustomize's nameReference transformer does not rewrite — a
-# stable literal name keeps the patch correct. A brand change rolls pods via
-# the deploy bumping the image tag (CI sets newTag to the built sha).
+# stable literal name keeps the patch correct.
 configMapGenerator:
   - name: wallet-web-brand
     files:
@@ -29,12 +28,11 @@ configMapGenerator:
     options:
       disableNameSuffixHash: true
 
-images:
-  - name: ghcr.io/luxfi/wallet-web
-    newTag: latest
-
-# Patch the Service CR: ingress host + the `volumes` entry that backs the
-# /public/brand.json mount (the base declares the volumeMount by name `brand`).
+# Patch the Service CR: pinned image tag, ingress host, and the `volumes` entry
+# that backs the /public/brand.json mount (the base declares the volumeMount by
+# name `brand`). NOTE: the tag lives in the CR's structured `spec.image.tag`, so
+# the kustomize `images:` transformer does NOT reach it — it is pinned here via a
+# JSON patch (the one working mechanism). Bump `value` to the built git sha.
 patches:
   - target:
       group: lux.cloud
@@ -42,6 +40,9 @@ patches:
       kind: Service
       name: wallet-web
     patch: |
+      - op: replace
+        path: /spec/image/tag
+        value: "28974b175"
       - op: add
         path: /spec/ingress/hosts
         value: