feat(mudcraft): auto-bootstrap LuckPerms tiers on every pod start

Adds postStart lifecycle hook that waits for RCON then applies the full
permission structure idempotently on every deploy. Tiers:

  Mortals:   mortal → hero → metamortal
  Immortals: angel → god

Permission structure is now git-managed in configmap-luckperms-bootstrap.yaml
— edit that file to change the permission hierarchy.

servers/legion/k8s/mudcraft/statefulset.yaml

@@ -17,7 +17,7 @@ spec:
       labels:
         app: mudcraft
       annotations:
-        kubectl.kubernetes.io/restartedAt: "2026-03-30T03:00:00Z"
+        kubectl.kubernetes.io/restartedAt: "2026-03-30T03:30:00Z"
     spec:
       terminationGracePeriodSeconds: 120
       securityContext:
@@ -104,6 +104,8 @@ spec:
               mountPath: /data/plugins
             - name: logs
               mountPath: /data/logs
+            - name: luckperms-bootstrap
+              mountPath: /bootstrap
           resources:
             requests:
               memory: 5Gi
@@ -112,6 +114,9 @@ spec:
               memory: 6Gi
               cpu: 4000m
           lifecycle:
+            postStart:
+              exec:
+                command: ["/bin/sh", "/bootstrap/bootstrap.sh"]
             preStop:
               exec:
                 command: ["/bin/sh", "-c", "rcon-cli stop && sleep 15"]
@@ -146,3 +151,7 @@ spec:
         - name: voicechat-config
           configMap:
             name: mudcraft-voicechat
+        - name: luckperms-bootstrap
+          configMap:
+            name: mudcraft-luckperms-bootstrap
+            defaultMode: 0755