fix: release v0.2.1 lesson deletes and large uploads

- Raise Traefik read timeout to 1h (compose dev/prod + k3s HelmChartConfig)
  so admin video uploads up to 200MB no longer 502 mid-upload.
- Migration 0029: cascade watch/quiz history on lesson delete and unlink
  dependent lessons, so removing a lesson or chapter stops 500ing.
- Add the Apollo cluster Helm overlay (values-apollo.yaml) for the deployed
  environment.
- k3s Traefik chart config also enables access logs, cross-namespace
  IngressRoutes, and fixes the Prometheus scrape port.

Bump appVersion/product.go/values tags to 0.2.1; chart version 0.2.3.

deploy/k3s/traefik-helmchartconfig.yaml

@@ -0,0 +1,43 @@
+# k3s Traefik customisation (HelmChartConfig for the built-in `traefik` chart).
+#
+# Apply with:  kubectl apply -f deploy/k3s/traefik-helmchartconfig.yaml
+#
+# Why: Traefik's entrypoint `readTimeout` defaults to 60s and covers reading the
+# *entire request including the body*. Admin video uploads (up to 200MB) that take
+# longer than 60s were cut off with a 502 before reaching the backend. Raise it to
+# 1 hour (use 0 to disable entirely).
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  failurePolicy: reinstall
+  valuesContent: |-
+    # ACCESSLOG tile -> ON; access logs go to container stdout (kubectl logs).
+    # Key is logs.access.enabled on the chart k3s ships (40.1.5);
+    # the top-level accessLog.enabled only exists on newer chart versions.
+    logs:
+      access:
+        enabled: true
+    # Allow IngressRoutes to reference Services living in other namespaces,
+    # e.g. argocd-server in `argocd`.
+    providers:
+      kubernetesCRD:
+        allowCrossNamespace: true
+    deployment:
+      podAnnotations:
+        # fix: metrics entrypoint listens on :9100, annotation said 8082
+        prometheus.io/port: "9100"
+        prometheus.io/scrape: "true"
+    # Allow slow, large uploads (admin video upload ≤ 200MB) to finish.
+    # Default is 60s; 3600s = 1h. Set to 0 to disable the cap.
+    ports:
+      web:
+        transport:
+          respondingTimeouts:
+            readTimeout: 3600
+      websecure:
+        transport:
+          respondingTimeouts:
+            readTimeout: 3600