feat: add K8s API server, orchestrator abstraction, and CI pipeline

- Add apps/api/ — Hono REST API server for managing pentest scans via K8s Jobs
  - POST/GET /api/scans, GET /api/scans/:id, cancel, report endpoints
  - Bearer token auth, Temporal client integration, K8s Job builder
  - Dockerfile, Kustomize manifests (Deployment, Service, RBAC)
- Add CLI orchestrator abstraction (docker.ts → Orchestrator interface)
  - DockerOrchestrator and K8sOrchestrator implementations
  - Backend detection via SHANNON_BACKEND env var or --backend flag
- Add CI workflow: type-check + lint on PR, build+push both images on main
- Switch all workflows to self-hosted runners (runners-farhoodliquor)
- Add shannon-api image build to release and release-beta workflows
- Add root infra/kustomization.yaml as Flux entry point
- Export PipelineProgress from @shannon/worker/pipeline

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/api/src/services/job-manager.ts

@@ -0,0 +1,35 @@
+/**
+ * K8s Job lifecycle management — create, delete, list worker Jobs.
+ */
+
+import type * as k8s from '@kubernetes/client-node';
+
+const WORKER_LABEL = 'shannon-worker';
+
+export async function createJob(batchApi: k8s.BatchV1Api, namespace: string, job: k8s.V1Job): Promise<void> {
+  await batchApi.createNamespacedJob({ namespace, body: job });
+}
+
+export async function deleteJob(batchApi: k8s.BatchV1Api, namespace: string, name: string): Promise<void> {
+  await batchApi.deleteNamespacedJob({
+    name,
+    namespace,
+    propagationPolicy: 'Background',
+  });
+}
+
+export async function getJob(batchApi: k8s.BatchV1Api, namespace: string, name: string): Promise<k8s.V1Job | null> {
+  try {
+    return await batchApi.readNamespacedJob({ name, namespace });
+  } catch {
+    return null;
+  }
+}
+
+export async function listWorkerJobs(batchApi: k8s.BatchV1Api, namespace: string): Promise<k8s.V1Job[]> {
+  const response = await batchApi.listNamespacedJob({
+    namespace,
+    labelSelector: `app=${WORKER_LABEL}`,
+  });
+  return response.items;
+}