ci: deploy stage applies manifests + sets images

Deploy now runs kubectl apply on manifests first (picking up
config changes), then updates images to the commit SHA.
Adds GitLab environment tracking for production.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -198,12 +198,21 @@ deploy:
     - mkdir -p ~/.kube
     - echo "$KUBECONFIG_DATA" | base64 -d > ~/.kube/config
     - chmod 600 ~/.kube/config
+  environment:
+    name: production
+    kubernetes:
+      namespace: foxhunt
   script:
+    # Apply manifests (picks up any config/resource changes)
+    - kubectl apply -f infra/k8s/databases/
+    - kubectl apply -f infra/k8s/services/
+    # Update images to this commit's build
     - |
       for svc in trading-service api-gateway broker-gateway-service ml-training-service backtesting-service trading-agent-service; do
         kubectl -n foxhunt set image deployment/${svc} ${svc}=${REGISTRY}/${svc}:${CI_COMMIT_SHA} || true
       done
       kubectl -n foxhunt set image deployment/web-gateway web-gateway=${REGISTRY}/web-gateway:${CI_COMMIT_SHA} || true
+    # Wait for rollouts
     - |
       for svc in trading-service api-gateway broker-gateway-service ml-training-service backtesting-service trading-agent-service web-gateway; do
         kubectl -n foxhunt rollout status deployment/${svc} --timeout=300s || true