feat(mudcraft): auto-bootstrap LuckPerms tiers on every pod start

Adds postStart lifecycle hook that waits for RCON then applies the full
permission structure idempotently on every deploy. Tiers:

  Mortals:   mortal → hero → metamortal
  Immortals: angel → god

Permission structure is now git-managed in configmap-luckperms-bootstrap.yaml
— edit that file to change the permission hierarchy.

servers/legion/k8s/mudcraft/configmap-luckperms-bootstrap.yaml

@@ -0,0 +1,92 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mudcraft-luckperms-bootstrap
+  namespace: mudcraft
+data:
+  bootstrap.sh: |
+    #!/bin/sh
+    # LuckPerms permission bootstrap — runs on every pod start via postStart hook.
+    # All commands are idempotent: re-running is safe, existing state is preserved.
+    #
+    # Tier hierarchy:
+    #
+    #   Mortals  (players): mortal → hero → metamortal
+    #   Immortals (staff):  angel → god
+    #
+    #   Players inherit upward within their branch only.
+    #   Staff tiers are assigned manually — never auto-promoted.
+
+    set -e
+
+    rc() { rcon-cli "$@" || true; }
+
+    echo "[bootstrap] Waiting for RCON..."
+    until rcon-cli help > /dev/null 2>&1; do sleep 3; done
+    echo "[bootstrap] RCON ready, applying LuckPerms tiers..."
+
+    # ── Mortal branch ─────────────────────────────────────────────────────────
+
+    rc "lp creategroup mortal"
+    rc "lp group mortal meta set display-name §7Mortal"
+    rc "lp group mortal setweight 0"
+
+    rc "lp creategroup hero"
+    rc "lp group hero meta set display-name §eHero"
+    rc "lp group hero setweight 10"
+    rc "lp group hero parent add mortal"
+    rc "lp group hero permission set essentials.tpa true"
+    rc "lp group hero permission set essentials.tpahere true"
+
+    rc "lp creategroup metamortal"
+    rc "lp group metamortal meta set display-name §aMetamortal"
+    rc "lp group metamortal setweight 20"
+    rc "lp group metamortal parent add hero"
+    rc "lp group metamortal permission set allow.flight true"
+    rc "lp group metamortal permission set minecraft.command.fly true"
+    rc "lp group metamortal permission set minecraft.command.tp true"
+    rc "lp group metamortal permission set minecraft.command.teleport true"
+
+    # ── Immortal branch ───────────────────────────────────────────────────────
+
+    rc "lp creategroup angel"
+    rc "lp group angel meta set display-name §bAngel"
+    rc "lp group angel setweight 30"
+    rc "lp group angel permission set minecraft.command.kick true"
+    rc "lp group angel permission set minecraft.command.tp true"
+    rc "lp group angel permission set minecraft.command.teleport true"
+    rc "lp group angel permission set minecraft.command.tphere true"
+    rc "lp group angel permission set minecraft.command.gamemode true"
+    rc "lp group angel permission set essentials.invsee true"
+    rc "lp group angel permission set essentials.seen true"
+    rc "lp group angel permission set essentials.msg true"
+    rc "lp group angel permission set essentials.tpa true"
+    rc "lp group angel permission set essentials.tpahere true"
+    rc "lp group angel permission set allow.flight true"
+    rc "lp group angel permission set minecraft.command.fly true"
+
+    rc "lp creategroup god"
+    rc "lp group god meta set display-name §4§lGod"
+    rc "lp group god setweight 40"
+    rc "lp group god parent add angel"
+    rc "lp group god permission set minecraft.command.ban true"
+    rc "lp group god permission set minecraft.command.ban-ip true"
+    rc "lp group god permission set minecraft.command.unban true"
+    rc "lp group god permission set minecraft.command.whitelist true"
+    rc "lp group god permission set minecraft.command.give true"
+    rc "lp group god permission set minecraft.command.time true"
+    rc "lp group god permission set minecraft.command.weather true"
+    rc "lp group god permission set minecraft.command.summon true"
+    rc "lp group god permission set minecraft.command.fill true"
+    rc "lp group god permission set minecraft.command.setblock true"
+    rc "lp group god permission set minecraft.command.stop false"
+    rc "lp group god permission set luckperms.* true"
+    rc "lp group god permission set worldedit.* true"
+    rc "lp group god permission set worldguard.* true"
+
+    # ── Default group → mortal ────────────────────────────────────────────────
+
+    rc "lp group default parent add mortal"
+
+    echo "[bootstrap] LuckPerms tiers applied."

servers/legion/k8s/mudcraft/statefulset.yaml

@@ -17,7 +17,7 @@ spec:
       labels:
         app: mudcraft
       annotations:
-        kubectl.kubernetes.io/restartedAt: "2026-03-30T03:00:00Z"
+        kubectl.kubernetes.io/restartedAt: "2026-03-30T03:30:00Z"
     spec:
       terminationGracePeriodSeconds: 120
       securityContext:
@@ -104,6 +104,8 @@ spec:
               mountPath: /data/plugins
             - name: logs
               mountPath: /data/logs
+            - name: luckperms-bootstrap
+              mountPath: /bootstrap
           resources:
             requests:
               memory: 5Gi
@@ -112,6 +114,9 @@ spec:
               memory: 6Gi
               cpu: 4000m
           lifecycle:
+            postStart:
+              exec:
+                command: ["/bin/sh", "/bootstrap/bootstrap.sh"]
             preStop:
               exec:
                 command: ["/bin/sh", "-c", "rcon-cli stop && sleep 15"]
@@ -146,3 +151,7 @@ spec:
         - name: voicechat-config
           configMap:
             name: mudcraft-voicechat
+        - name: luckperms-bootstrap
+          configMap:
+            name: mudcraft-luckperms-bootstrap
+            defaultMode: 0755