Add DeepSeek Harness Web agents-as-a-service platform pattern (#2)

Port the upstream hermes-agents-as-a-service example to DSH Web:
numbered manifests (00-prereqs .. 50-gateway), a Python gateway
(signup, per-user tokens, wake-on-connect proxy, idle suspend),
run-test-kind.sh smoke test, and docs. Fix deploy/k8s/sandbox-template.yaml
(v1beta1, correct image, volumeClaimTemplates). Add a validate workflow
(manifest server dry-run + gateway unit tests).

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/dsh-agents-as-a-service/00-prereqs.yaml

@@ -0,0 +1,27 @@
+# DSH "Agents as a Service" — prerequisites: namespace + shared provider key.
+#
+# The dsh-provider-keys Secret is deliberately NOT committed with a usable
+# value. DEEPSEEK_API_KEY reaches every tenant sandbox (injected via envFrom
+# on the SandboxTemplate, stamped before any user exists — a warm-pool
+# constraint), so a real key committed here would be shared by every install
+# of this example. Generate a fresh value per install (README step 1;
+# run-test-kind.sh uses a throwaway):
+#
+#   kubectl -n dsh-demo create secret generic dsh-provider-keys \
+#     --from-literal=DEEPSEEK_API_KEY="sk-..."
+#
+# All the infrastructure in this example works without a real key; only
+# actual model calls need one.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dsh-demo
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: dsh-provider-keys
+  namespace: dsh-demo
+type: Opaque
+# stringData:
+#   DEEPSEEK_API_KEY: "sk-your-key-here"