feat: deploy to Frostmoln production (#203)

Part of the dancefinder.unbound.se cutover to Frostmoln Production (infra: unboundsoftware/infra#1896, already applied).

- Replaces the AWS `deploy-prod` job (failing since CI left AWS) with `deploy-prod-frostmoln` (`deploy prod-frostmoln -n dancefinder`), as schemas did.
- Restricted securityContext (runAsNonRoot, drop ALL, seccomp RuntimeDefault) and `imagePullSecrets: oci-registry` (Platform registry).
- Runs as uid 65534. The Frostmoln CronJob is suspended by hand after its first deploy and resumed by `migrate-db.sh dancefinder --cutover` (not in the manifest, so later deploys don't re-suspend it).

Merging deploys to Frostmoln only; DNS still points at AWS until the cutover.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi
Reviewed-on: #203

k8s/deploy.yaml

@@ -11,8 +11,19 @@ spec:
     spec:
       template:
         spec:
+          imagePullSecrets:
+            - name: oci-registry
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
           containers:
             - name: dancefetcher
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
               image: ${IMAGE}
               imagePullPolicy: Always
               resources: