Add deploy step: rollout restart after image build

Uses ServiceAccount with minimal RBAC (get/patch deployments in bbb namespace).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.woodpecker/build.yml

@@ -28,3 +28,18 @@ steps:
         from_secret: docker_username
       password:
         from_secret: docker_password
+
+  - name: deploy
+    image: bitnami/kubectl:latest
+    environment:
+      K8S_TOKEN:
+        from_secret: k8s_token
+      K8S_SERVER:
+        from_secret: k8s_server
+    commands:
+      - kubectl config set-cluster k3s --server=$K8S_SERVER --insecure-skip-tls-verify=true
+      - kubectl config set-credentials deployer --token=$K8S_TOKEN
+      - kubectl config set-context deploy --cluster=k3s --user=deployer --namespace=bbb
+      - kubectl config use-context deploy
+      - kubectl rollout restart deploy/bbb-backend deploy/bbb-frontend -n bbb
+      - kubectl rollout status deploy/bbb-backend deploy/bbb-frontend -n bbb --timeout=120s