inside.hoortrend.com moved to its own repository (hoortrend/inside) with its
history; this repository now holds a small web application that shows it is
deployed, running and reachable: each page says which pod and which node served
it, which commit runs, since when, and how many requests this pod answered.

- app/server.py: Python's standard library only; /, /api/info, /healthz;
  French or English; strict CSP and security headers.
- tests: 9 unittest cases over real HTTP.
- Dockerfile: python:3.12-alpine, unprivileged, APP_VERSION = the commit.
- k8s: namespace demo-app (Pod Security restricted), NetworkPolicy (its port
  in, nothing out), 2 replicas with probes, limits, read-only root and no API
  token, Service, PodDisruptionBudget, Ingress demo.hoortrend.com with its
  Let's Encrypt certificate and a rate limit.
- pipeline: tests, manifests, gitleaks -> Kaniko -> Trivy -> promote + deploy ->
  from the Internet, /api/info must report this pipeline's commit.

Checked locally: tests pass; the image runs read-only, as a non-root user with no
capability; Trivy finds no HIGH or CRITICAL vulnerability.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>