chore(receiver): packaging, k8s manifests, CI/release, docs

Dockerfile.receiver (CGO-free, /data volume), receiver image in CI and
tag releases, receiver binary in release archives, make build-receiver,
example k8s manifests (deployment/service/ingress/secret/pvc) under
deploy/k8s/receiver/, and README coverage including sender/receiver
token pairing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/k8s/receiver/deployment.yaml

@@ -0,0 +1,57 @@
+# TEMPLATE — single-replica receiver deployment. Keep replicas at 1 while
+# using the SQLite backend: the database file on the RWO volume supports only
+# one writer. With RECEIVER_MYSQL_DSN you may scale out and drop the volume.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: exploredns-receiver
+  namespace: exploredns-receiver
+  labels:
+    app: exploredns-receiver
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate # RWO volume: never run old and new pods concurrently
+  selector:
+    matchLabels:
+      app: exploredns-receiver
+  template:
+    metadata:
+      labels:
+        app: exploredns-receiver
+    spec:
+      containers:
+        - name: receiver
+          image: gitea.hansenits.com.au/hits/exploredns-receiver:latest
+          ports:
+            - name: http
+              containerPort: 8080
+          envFrom:
+            - secretRef:
+                name: exploredns-receiver
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 15
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 2
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: exploredns-receiver-data

deploy/k8s/receiver/ingress.yaml

@@ -0,0 +1,33 @@
+# TEMPLATE — replace receiver.example.com with your real host and wire up
+# TLS for your cluster (the webhook bearer token and admin password travel
+# in headers, so plain HTTP is not acceptable across the internet).
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: exploredns-receiver
+  namespace: exploredns-receiver
+  annotations: {}
+    # nginx ingress controller:
+    # cert-manager.io/cluster-issuer: letsencrypt
+    # nginx.ingress.kubernetes.io/proxy-body-size: 1m
+    #
+    # traefik:
+    # traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    # traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  # ingressClassName: nginx
+  tls:
+    - hosts:
+        - receiver.example.com
+      secretName: exploredns-receiver-tls # created by cert-manager or by hand
+  rules:
+    - host: receiver.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: exploredns-receiver
+                port:
+                  name: http

deploy/k8s/receiver/namespace.yaml

@@ -0,0 +1,6 @@
+# TEMPLATE — optional. Skip this file (and drop the namespace fields from the
+# other manifests) to deploy into an existing namespace.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: exploredns-receiver

deploy/k8s/receiver/pvc.yaml

@@ -0,0 +1,16 @@
+# TEMPLATE — backing storage for the SQLite database (RECEIVER_SQLITE_PATH
+# defaults to /data/exploredns-receiver.db in the container image). Not needed
+# when RECEIVER_MYSQL_DSN is set, but harmless to keep. Set storageClassName
+# if your cluster has no default class.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: exploredns-receiver-data
+  namespace: exploredns-receiver
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  # storageClassName: standard

deploy/k8s/receiver/secret.yaml

@@ -0,0 +1,25 @@
+# TEMPLATE — fill in real values before applying, or create the secret
+# imperatively instead and never commit credentials:
+#
+#   kubectl -n exploredns-receiver create secret generic exploredns-receiver \
+#     --from-literal=RECEIVER_ADMIN_USER=admin \
+#     --from-literal=RECEIVER_ADMIN_PASSWORD='change-me' \
+#     --from-literal=RECEIVER_INGEST_TOKEN='change-me-too'
+#
+# The deployment loads every key here as an environment variable (envFrom).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: exploredns-receiver
+  namespace: exploredns-receiver
+type: Opaque
+stringData:
+  RECEIVER_ADMIN_USER: admin
+  RECEIVER_ADMIN_PASSWORD: change-me
+  # Bearer token the main app must send on POST /webhook. Must match the
+  # sender's EXPLOREDNS_WEBHOOK_TOKEN. Leave unset to accept unauthenticated
+  # posts (not recommended for an internet-facing receiver).
+  RECEIVER_INGEST_TOKEN: change-me-too
+  # Uncomment to store events in an external MySQL instead of the SQLite
+  # file on the PVC (go-sql-driver DSN).
+  # RECEIVER_MYSQL_DSN: "user:pass@tcp(mysql.example.com:3306)/exploredns"

deploy/k8s/receiver/service.yaml

@@ -0,0 +1,16 @@
+# TEMPLATE — cluster-internal service in front of the receiver pod.
+apiVersion: v1
+kind: Service
+metadata:
+  name: exploredns-receiver
+  namespace: exploredns-receiver
+  labels:
+    app: exploredns-receiver
+spec:
+  type: ClusterIP
+  selector:
+    app: exploredns-receiver
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http