feat: scaffold Flux manifests for zip-enrichment, holidays, air-quality API services

Closes leeworks-agents/api-company#46

Add flux/ directories for all three API services, each containing:
- namespace.yaml — Kubernetes Namespace
- helmrelease.yaml — HelmRelease using bedag/raw chart with Deployment,
  Service, and Ingress (TLS via cert-manager letsencrypt-prod)
- externalsecret.yaml — placeholder/comment for RapidAPI proxy-secret;
  includes kubectl manual-create instructions until ESO is deployed
- kustomization.yaml — per-directory Kustomize resources list

Services and subdomains:
  zip-enrichment  → zip.leeworks.dev
  holidays        → holidays.leeworks.dev
  air-quality     → aqi.leeworks.dev

Images:
  registry.leeworks.dev/zip-enrichment/server:latest
  registry.leeworks.dev/holidays/server:latest
  registry.leeworks.dev/air-quality/server:latest

Update root flux/kustomization.yaml to include all three new directories.
kustomize build flux/ passes with zero errors.

flux/air-quality/externalsecret.yaml

@@ -0,0 +1,29 @@
+# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed.
+# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and
+# the external-secrets operator are running in the cluster.
+#
+# Example (uncomment and fill in secretStore name):
+#
+# apiVersion: external-secrets.io/v1beta1
+# kind: ExternalSecret
+# metadata:
+#   name: rapidapi-proxy-secret
+#   namespace: air-quality
+# spec:
+#   refreshInterval: 1h
+#   secretStoreRef:
+#     name: <your-secret-store>
+#     kind: ClusterSecretStore
+#   target:
+#     name: rapidapi-proxy-secret
+#     creationPolicy: Owner
+#   data:
+#     - secretKey: X-RapidAPI-Proxy-Secret
+#       remoteRef:
+#         key: rapidapi/air-quality
+#         property: proxy-secret
+#
+# Until then, create manually:
+# kubectl create secret generic rapidapi-proxy-secret \
+#   --from-literal=X-RapidAPI-Proxy-Secret=<value> \
+#   -n air-quality

flux/air-quality/helmrelease.yaml

@@ -0,0 +1,101 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: air-quality
+  namespace: air-quality
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: raw
+      version: ">=0.2.0"
+      sourceRef:
+        kind: HelmRepository
+        name: bedag
+        namespace: flux-system
+      interval: 60m
+  values:
+    resources:
+      - apiVersion: apps/v1
+        kind: Deployment
+        metadata:
+          name: air-quality
+          namespace: air-quality
+        spec:
+          replicas: 1
+          selector:
+            matchLabels:
+              app: air-quality
+          template:
+            metadata:
+              labels:
+                app: air-quality
+            spec:
+              imagePullSecrets:
+                - name: gitea-registry
+              containers:
+                - name: air-quality
+                  image: registry.leeworks.dev/air-quality/server:latest
+                  ports:
+                    - containerPort: 3000
+                  env:
+                    - name: RAPIDAPI_PROXY_SECRET
+                      valueFrom:
+                        secretKeyRef:
+                          name: rapidapi-proxy-secret
+                          key: X-RapidAPI-Proxy-Secret
+                  resources:
+                    requests:
+                      cpu: 50m
+                      memory: 128Mi
+                    limits:
+                      cpu: 500m
+                      memory: 256Mi
+                  livenessProbe:
+                    httpGet:
+                      path: /health
+                      port: 3000
+                    initialDelaySeconds: 10
+                    periodSeconds: 30
+                  readinessProbe:
+                    httpGet:
+                      path: /health
+                      port: 3000
+                    initialDelaySeconds: 5
+                    periodSeconds: 10
+      - apiVersion: v1
+        kind: Service
+        metadata:
+          name: air-quality
+          namespace: air-quality
+        spec:
+          selector:
+            app: air-quality
+          ports:
+            - port: 80
+              targetPort: 3000
+      - apiVersion: networking.k8s.io/v1
+        kind: Ingress
+        metadata:
+          name: air-quality
+          namespace: air-quality
+          annotations:
+            cert-manager.io/cluster-issuer: letsencrypt-prod
+            nginx.ingress.kubernetes.io/ssl-redirect: "true"
+        spec:
+          ingressClassName: nginx
+          tls:
+            - hosts:
+                - aqi.leeworks.dev
+              secretName: air-quality-tls
+          rules:
+            - host: aqi.leeworks.dev
+              http:
+                paths:
+                  - path: /
+                    pathType: Prefix
+                    backend:
+                      service:
+                        name: air-quality
+                        port:
+                          number: 80

flux/air-quality/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - externalsecret.yaml
+  - helmrelease.yaml

flux/air-quality/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: air-quality