k8s: drop host Docker socket mount from instant-api (P1-W5-14)

The instant-api Deployment mounted the node's /run/docker.sock as a
hostPath volume and set DOCKER_HOST. Write access to the host Docker
socket is equivalent to root on the node — a container-escape primitive
on the public, internet-facing api service.

Prod builds run via kaniko-in-k8s (verified: instant-config
COMPUTE_PROVIDER=k8s), so the Docker socket is unused. Remove:
  - the docker-sock hostPath volume
  - its volumeMount on the api container
  - the DOCKER_HOST env var

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

k8s/app.yaml

@@ -51,25 +51,15 @@ spec:
               until pg_isready -h postgres-platform -U instant -d instant_platform; do
                 echo "Waiting for platform DB..."; sleep 2
               done
-      volumes:
-        - name: docker-sock
-          hostPath:
-            path: /run/docker.sock   # Lima VM's actual dockerd socket (not the macOS-forwarded one)
-            type: Socket
       containers:
         - name: api
           image: instant-api:local   # built with: docker build -t instant-api:local .
           ports:
             - containerPort: 8080
-          volumeMounts:
-            - name: docker-sock
-              mountPath: /var/run/docker.sock
           envFrom:
             - configMapRef:
                 name: instant-config
           env:
-            - name: DOCKER_HOST
-              value: unix:///var/run/docker.sock
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef: