Goal: secure M1 + basic infra
Goal: k3s on C1–C3 and Rook/Ceph
Goal: Forgejo runners + isolated runs to manage tenant namespace
Goal: collect usage, apply credits/discounts, invoice preview
Goal: minimal production safety
Goal: friend/family pilot