feat(frontend): Kinetic Precision design system — new lime theme, glassmorphism, redesigned pages

- New design system: Stitch (kinetic-precision.css) with lime (#cafd00) accent
- New Google Fonts: Lexend, Plus Jakarta Sans, Space Grotesk
- New page: BenchmarksPage with strength/endurance/body tracking
- Redesigned: Dashboard, ProgressPage, WorkoutPage, LoginPage + LoginPage.css
- Add shared glassmorphism nav, kinetic buttons, intensity indicators
- Build: 265KB JS / 88KB CSS / 2.54s (clean)

scripts/preflight/01-dns-check.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# DNS Validation for Production Ingress
+NAMESPACE="gravl-prod"
+echo "Checking DNS records for $NAMESPACE..."
+kubectl get ingress -n "$NAMESPACE" -o jsonpath='{.items[*].spec.rules[*].host}' | \
+  tr ' ' '\n' | while read host; do
+    if [ -n "$host" ]; then
+      resolved=$(dig +short "$host" 2>/dev/null | head -1 || echo "UNRESOLVED")
+      echo "  $host → $resolved"
+    fi
+  done

scripts/preflight/02-health-check.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# Service Health Check Framework
+NAMESPACE="gravl-prod"
+echo "=== Service Health Checks ==="
+kubectl get pods -n "$NAMESPACE" -o wide
+echo ""
+echo "Pod status summary:"
+kubectl get pods -n "$NAMESPACE" --no-headers | \
+  awk '{print $3}' | sort | uniq -c

scripts/preflight/03-load-test-setup.js

@@ -0,0 +1,20 @@
+import http from 'k6/http';
+import { check, sleep } from 'k6';
+
+export const options = {
+  vus: 10,
+  duration: '1m',
+  thresholds: {
+    http_req_duration: ['p(95)<500', 'p(99)<1000'],
+    http_req_failed: ['rate<0.01'],
+  },
+};
+
+export default function() {
+  const res = http.get('https://gravl-prod.example.com/api/health');
+  check(res, {
+    'status is 200': (r) => r.status === 200,
+    'response time OK': (r) => r.timings.duration < 500,
+  });
+  sleep(1);
+}

scripts/preflight/04-backup-check.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+# Backup Procedure Validation
+echo "=== Backup Status Check ==="
+echo "Checking sealed-secrets backup..."
+kubectl get secret -n kube-system | grep -E 'sealed-secrets-key|backup' || echo "⚠️  No backup secret found"
+
+echo ""
+echo "Checking persistent volumes..."
+kubectl get pv | grep -E 'gravl|prod' || echo "No Gravl PVs found (ephemeral storage)"
+
+echo ""
+echo "Checking backup jobs..."
+kubectl get cronjob --all-namespaces | grep -i backup || echo "No backup CronJobs configured"

scripts/preflight/05-rollback-safety.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# Rollback Safety Verification
+NAMESPACE="gravl-prod"
+STAGING_NS="gravl-staging"
+
+echo "=== Rollback Safety Checks ==="
+echo ""
+echo "Staging environment status (rollback target):"
+kubectl get deployment -n "$STAGING_NS" -o wide
+echo ""
+echo "Staging service health:"
+kubectl get svc -n "$STAGING_NS" -o wide
+echo ""
+echo "Deployment revision history:"
+kubectl rollout history deployment --all-namespaces | grep gravl || echo "No rollout history yet"