fix: release v0.2.1 lesson deletes and large uploads

- Raise Traefik read timeout to 1h (compose dev/prod + k3s HelmChartConfig)
  so admin video uploads up to 200MB no longer 502 mid-upload.
- Migration 0029: cascade watch/quiz history on lesson delete and unlink
  dependent lessons, so removing a lesson or chapter stops 500ing.
- Add the Apollo cluster Helm overlay (values-apollo.yaml) for the deployed
  environment.
- k3s Traefik chart config also enables access logs, cross-namespace
  IngressRoutes, and fixes the Prometheus scrape port.

Bump appVersion/product.go/values tags to 0.2.1; chart version 0.2.3.

deploy/compose/compose.dev.yaml

@@ -63,6 +63,9 @@ services:
       - --entrypoints.web.http.redirections.entrypoint.permanent=true
       - --entrypoints.web.http.aliasHeadersStrategy=delete
       - --entrypoints.websecure.http.aliasHeadersStrategy=delete
+      # Allow slow, large uploads (admin video ≤ 200MB); default is 60s.
+      - --entrypoints.web.transport.respondingTimeouts.readTimeout=3600
+      - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=3600
       # Dev: Traefik default certificate (browser warning expected on localhost).
       - --api.dashboard=true
       - --api.insecure=true

deploy/compose/compose.prod.yaml

@@ -71,6 +71,9 @@ services:
       - --entrypoints.web.http.redirections.entrypoint.permanent=true
       - --entrypoints.web.http.aliasHeadersStrategy=delete
       - --entrypoints.websecure.http.aliasHeadersStrategy=delete
+      # Allow slow, large uploads (admin video ≤ 200MB); default is 60s.
+      - --entrypoints.web.transport.respondingTimeouts.readTimeout=3600
+      - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=3600
       - --certificatesresolvers.le.acme.email=${ACME_EMAIL:?ACME_EMAIL must be set}
       - --certificatesresolvers.le.acme.storage=/data/acme.json
       - --certificatesresolvers.le.acme.httpchallenge=true