fix: lower CPU limit to 200m to fit rolling update within tenant quota

backend/src/db.rs

@@ -13,6 +13,17 @@ pub async fn init() -> Result<SqlitePool, sqlx::Error> {
     Ok(pool)
 }
 
+pub async fn maybe_seed_demo(pool: &SqlitePool) {
+    if std::env::var("DEMO").as_deref() != Ok("true") {
+        return;
+    }
+    let seed = include_str!("../demo/demo_seed.sql");
+    match sqlx::raw_sql(seed).execute(pool).await {
+        Ok(_) => tracing::info!("DEMO seed applied"),
+        Err(e) => tracing::warn!("DEMO seed failed: {e}"),
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

backend/src/main.rs

@@ -29,6 +29,7 @@ async fn main() {
     }
 
     let pool = db::init().await.expect("db init failed");
+    db::maybe_seed_demo(&pool).await;
 
     let static_dir = std::env::var("STATIC_DIR")
         .unwrap_or_else(|_| "../frontend/build".into());

deploy/templates/deployment.yaml

@@ -33,6 +33,10 @@ spec:
               value: {{ .Values.env.DATABASE_URL | quote }}
             - name: STATIC_DIR
               value: {{ .Values.env.STATIC_DIR | quote }}
+            {{- range $k, $v := .Values.env.extra }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+            {{- end }}
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:

deploy/values.yaml

@@ -20,7 +20,7 @@ resources:
     cpu: 50m
     memory: 64Mi
   limits:
-    cpu: 500m
+    cpu: 200m
     memory: 256Mi
 
 pvc:
@@ -39,7 +39,7 @@ httpRoute:
   hostnames:
     - tutor.puchstein.dev
   sectionName: https-tutor-puchstein-dev
-  httpRedirectSectionName: http-tutor-puchstein-dev
+  httpRedirectSectionName: http
 
 # JWT_SECRET provisioned as a pre-existing K8s Secret named here.
 # Do not set jwtSecretValue in committed values — provision via kubectl manually.
@@ -48,6 +48,9 @@ jwtSecretName: tutortool-jwt
 env:
   DATABASE_URL: sqlite:/data/attendance.db
   STATIC_DIR: /app/frontend/build
+  extra: {}
+  # extra:
+  #   DEMO: "true"   # seeds demo data on startup (idempotent, INSERT OR IGNORE)
 
 vpa:
   enabled: false