feat(bookstore): add kustomize-based GitOps deployment

- Create base manifests (deployment, service, ghcr-secret)
- Add bookstore overlay with image tag management
- Update ArgoCD Application to use Kustomize single-source
- Follow youngth-guard pattern for consistency

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/ljwx-bookstore/base/deployment.yaml

@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bookstore
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: bookstore
+  template:
+    metadata:
+      labels:
+        app: bookstore
+    spec:
+      imagePullSecrets:
+        - name: ghcr-secret
+      containers:
+        - name: bookstore
+          image: ghcr.io/brunogaosz/ljwx-bookstore/bookstore:bookstore-latest
+          ports:
+            - containerPort: 8080
+          env:
+            - name: SPRING_PROFILES_ACTIVE
+              value: "prod"
+            - name: SERVER_PORT
+              value: "8080"
+            # Database configuration from infra Postgres
+            - name: SPRING_DATASOURCE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: bookstore-db-credentials
+                  key: SPRING_DATASOURCE_URL
+            - name: SPRING_DATASOURCE_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: bookstore-db-credentials
+                  key: SPRING_DATASOURCE_USERNAME
+            - name: SPRING_DATASOURCE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: bookstore-db-credentials
+                  key: SPRING_DATASOURCE_PASSWORD
+          livenessProbe:
+            httpGet:
+              path: /actuator/health
+              port: 8080
+            initialDelaySeconds: 120
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /actuator/health/readiness
+              port: 8080
+            initialDelaySeconds: 60
+            periodSeconds: 10
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "500m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"

apps/ljwx-bookstore/base/ghcr-secret.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ghcr-secret
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: eyJhdXRocyI6eyJnaGNyLmlvIjp7InVzZXJuYW1lIjoiQnJ1bm9HYW9TWiIsInBhc3N3b3JkIjoiZ2hwX05UVVNwTW9kOURhcXAxeGxCTWliOGxnV09WMUJidTF5MjJ4cyIsImVtYWlsIjoieW91ci1lbWFpbEBleGFtcGxlLmNvbSIsImF1dGgiOiJRbkoxYm05SFlXOVRXanBuYUhCZlRsUlZVM0JOYjJRNVJHRnhjREY0YkVKTmFXSTRiR2RYVDFZeFFtSjFNWGt5TW5oeiJ9fX0=

apps/ljwx-bookstore/base/kustomization.yaml

@@ -0,0 +1,4 @@
+resources:
+  - deployment.yaml
+  - service.yaml
+  - ghcr-secret.yaml

apps/ljwx-bookstore/base/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: bookstore
+spec:
+  selector:
+    app: bookstore
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+  type: ClusterIP

apps/ljwx-bookstore/overlays/bookstore/kustomization.yaml

@@ -0,0 +1,9 @@
+resources:
+  - ../../base
+
+namespace: bookstore
+
+images:
+  - name: ghcr.io/brunogaosz/ljwx-bookstore/bookstore
+    newName: ghcr.io/brunogaosz/ljwx-bookstore/bookstore
+    newTag: "bookstore-latest"

argocd-apps/40-ljwx-bookstore.yaml

@@ -8,41 +8,22 @@ metadata:
   labels:
     environment: bookstore
     project: ljwx-bookstore
-  annotations:
-    argocd.argoproj.io/manifest-generate-paths: .
 spec:
   project: ljwx
-
-  # 多源配置：从两个 repo 拉取配置
-  sources:
-    # 源 1: Helm Chart（bookstore 代码仓库）
-    - repoURL: 'https://github.com/BrunoGaoSZ/ljwx-bookstore.git'
-      targetRevision: main
-      path: helm
-      helm:
-        valueFiles:
-          # 引用源 2 的 values 文件
-          - $values/apps/ljwx-bookstore/base/values-common.yaml
-          - $values/apps/ljwx-bookstore/overlays/bookstore/values.yaml
-
-    # 源 2: Values 文件（GitOps 仓库）
-    - repoURL: 'https://github.com/BrunoGaoSZ/ljwx-deploy.git'
-      targetRevision: main
-      ref: values
-
-  # 目标配置：部署到 bookstore 命名空间
+  source:
+    repoURL: 'https://github.com/BrunoGaoSZ/ljwx-deploy.git'
+    targetRevision: main
+    path: apps/ljwx-bookstore/overlays/bookstore
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: bookstore
-
-  # 同步策略
   syncPolicy:
     automated:
-      prune: true      # 自动删除 Git 中不存在的资源
-      selfHeal: true   # 自动修复手动更改
+      prune: true
+      selfHeal: true
       allowEmpty: false
     syncOptions:
-      - CreateNamespace=true  # 自动创建 bookstore 命名空间
+      - CreateNamespace=true
       - PrunePropagationPolicy=foreground
       - PruneLast=true
     retry:
@@ -51,10 +32,3 @@ spec:
         duration: 5s
         factor: 2
         maxDuration: 3m
-
-  # 忽略某些字段的差异
-  ignoreDifferences:
-    - group: apps
-      kind: Deployment
-      jsonPointers:
-        - /spec/replicas