docs: add the first-deployment checklist

[TheMeinerLP]

Requested after the 0.3.1 release: what a person has to supply to get Sturnus running in the cluster.

The ordering is the part worth reviewing. It is not the obvious one:

The FLUX manifests get merged first, deliberately without the secret, and the pods CrashLoopBackOff until it follows. The reason is that two of the seven secret values do not exist yet — Rook generates the S3 access and secret key when it reconciles the CephObjectStoreUser that same PR adds. There is nothing to put in a secret before that has happened, and inventing them produces a bucket nobody can write to.

Beyond the ordering, the document records the things that bite in a way the error message does not explain:

• The bot's role has to sit above the consent role in the server's role list, or /setup fails on permissions — Discord will not let a bot edit a role positioned above its own.
• The database password appears in two files that must agree: the connection string and the CloudNativePG role. A mismatch surfaces as an authentication error that says nothing about the mismatch.
• The OAuth redirect URI fails late — after a participant has already logged in and consented — and the error appears in Outline, not in Sturnus.
• Only one privileged intent needs enabling. Anyone hunting for a "Voice States Intent" toggle is looking for something that does not exist.
• openssl rand -base64 32 for the master key, not a passphrase: it must decode to exactly 32 bytes.

It also lists what is not outstanding, since several things look like open questions and are not: the chart, manifests and image are done and released, the image is in Harbor, and the FLUX secret template's variable names have been corrected against the code.

Verification

Every command and name was checked against the code and the manifests rather than written from memory:

• the Rook secret name, against the FLUX template
• the ingress host, against ingress.yaml
• /oauth/callback, against the link server's route table
• the 32-byte requirement, against crypto.py — and openssl rand -base64 32 actually decoded and measured
• the six slash commands and the policy_url / document_target config keys, against the source

That care is not decorative: the secret template in the FLUX repository was written from the design document instead of the code, and had three variable names wrong and two missing. Every pod would have failed to start.