feat: Helm chart for Kubernetes deployment

[IKatsuba]

Summary

• Adds charts/nx-cache-server/ — Deployment, Service, Secret, ServiceAccount, with /health liveness/readiness probes.
• Secret strategy is flexible: chart-managed Secret from values or secrets.existingSecret pointing at an externally managed one (External Secrets / Sealed Secrets / Vault).
• ServiceAccount annotations are configurable for IRSA / GKE Workload Identity (avoid static AWS keys).
• CI: new helm-lint job on every push/PR + new helm-publish job that runs on release: published and pushes the chart as an OCI artifact to ghcr.io/ikatsuba/charts/nx-cache-server, versioned to the release tag — same trigger as the Docker image.
• README updated with a Using Helm (Kubernetes) section pointing at the chart's own README for the full values reference.

Resolves #4.

Test plan

Verified locally before opening the PR:

• helm lint charts/nx-cache-server — clean
• helm template — default render
• helm template --set secrets.existingSecret=... — Secret manifest is skipped, Deployment references the external one
• helm template without required values — fails with explicit required messages
• actionlint .github/workflows/main.yml — clean
• helm install --dry-run against a real cluster (orbstack) — OK
• helm install --wait on orbstack (with --set image.tag=main since no v0.1.0 release exists yet) — Pod Ready 1/1
• curl /health via port-forward → HTTP 200 "OK"
• curl /v1/cache/abc123 without Authorization → HTTP 401 (auth gate works)
• curl /v1/cache/abc123 with Bearer devtoken → reaches S3 client (auth path verified)

Post-merge follow-ups (manual, one-time)

• Cut a GitHub Release tagged vX.Y.Z to trigger helm-publish.
• After the first chart publish, set the ikatsuba/charts/nx-cache-server package visibility to Public in the GHCR UI so helm pull oci://... works without auth.