feat: add K8s API server, orchestrator abstraction, and CI pipeline

- Add apps/api/ — Hono REST API server for managing pentest scans via K8s Jobs
  - POST/GET /api/scans, GET /api/scans/:id, cancel, report endpoints
  - Bearer token auth, Temporal client integration, K8s Job builder
  - Dockerfile, Kustomize manifests (Deployment, Service, RBAC)
- Add CLI orchestrator abstraction (docker.ts → Orchestrator interface)
  - DockerOrchestrator and K8sOrchestrator implementations
  - Backend detection via SHANNON_BACKEND env var or --backend flag
- Add CI workflow: type-check + lint on PR, build+push both images on main
- Switch all workflows to self-hosted runners (runners-farhoodliquor)
- Add shannon-api image build to release and release-beta workflows
- Add root infra/kustomization.yaml as Flux entry point
- Export PipelineProgress from @shannon/worker/pipeline

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/api/src/services/temporal-client.ts

@@ -0,0 +1,36 @@
+/**
+ * Temporal client management — connection lifecycle and workflow operations.
+ * Uses @temporalio/client (not worker) since the API server only submits and queries workflows.
+ */
+
+import type { PipelineProgress } from '@shannon/worker/pipeline';
+import { Client, Connection } from '@temporalio/client';
+
+export interface TemporalClients {
+  readonly client: Client;
+  readonly connection: Connection;
+}
+
+export async function connectTemporal(address: string): Promise<TemporalClients> {
+  console.log(`Connecting to Temporal at ${address}...`);
+  const connection = await Connection.connect({ address });
+  const client = new Client({ connection });
+  console.log('Temporal connected.');
+  return { client, connection };
+}
+
+export async function disconnectTemporal(clients: TemporalClients): Promise<void> {
+  await clients.connection.close();
+}
+
+/** Query a workflow's progress via the getProgress query. */
+export async function queryProgress(client: Client, workflowId: string): Promise<PipelineProgress> {
+  const handle = client.workflow.getHandle(workflowId);
+  return handle.query<PipelineProgress>('getProgress');
+}
+
+/** Cancel a running workflow. */
+export async function cancelWorkflow(client: Client, workflowId: string): Promise<void> {
+  const handle = client.workflow.getHandle(workflowId);
+  await handle.cancel();
+}