feat: poblar scaffold inicial del shape rest-api/python

Reemplaza el placeholder mínimo previo por el scaffold canónico del
golden path rest-api/python (entry point para tier free-trial):

- code/app/main.py — FastAPI con /health (sin DB), /metrics, middleware
  correlation_id, settings Pydantic
- code/tests/ — pytest + httpx TestClient (sin testcontainers, sin Docker)
- helm/APP_NAME/ — chart minimal: Deployment, Service, IngressRoute,
  NetworkPolicy. SIN Job Alembic, SIN ServiceMonitor, SIN claim de BD
- coralware-shape.yaml — shapeVersion 1.0.0, minTier free-trial,
  promotionPath -> web-backend-python cuando se requiera persistencia
- .gitea/workflows/APP_NAME-build.yaml — invoca reusable workflow ADR-038
  + job helm-deploy con KUBECONFIG_TENANT_B64

Diferencias con web-backend/python: sin alembic, sin BD, sin
testcontainers, NetworkPolicy sin acceso a ns-addons.

Placeholders __APP_NAME__, __TIER__, __TENANT_ID__, __TENANT_ID_NODASHES__
serán sustituidos server-side por repo-provisioner.

El openspec/ del golden path NO se sincroniza al repo Gitea (gobernanza
interna de Coralware).

Refs: ADR-027 (Golden Paths), ADR-038 (CI), ADR-053 (referencia anatomía).

.gitea/workflows/APP_NAME-build.yaml

@@ -0,0 +1,83 @@
+name: __APP_NAME__ — build & deploy
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'code/**'
+      - 'helm/**'
+      - '.gitea/workflows/__APP_NAME__-build.yaml'
+
+jobs:
+  # Tests + build + push a Harbor — patrón ADR-038 reusable workflow.
+  build:
+    uses: coralware/IDP/.gitea/workflows/_python-microservice.yaml@main
+    with:
+      service_name: __APP_NAME__
+      service_dir: code
+      uses_metrics: false
+      coverage_threshold: 80
+      trivy_exit_code: 0
+      enforce_rollback: false
+
+  # Deploy al cluster del tenant — Helm upgrade --install (sin hook Alembic).
+  helm-deploy:
+    needs: build
+    runs-on: [self-hosted, linux/amd64]
+    container: alpine/helm:3.14.4
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install kubectl
+        run: apk add --no-cache kubectl
+
+      - name: Decodificar kubeconfig del tenant
+        env:
+          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_TENANT_B64 }}
+        run: |
+          if [ -z "$KUBECONFIG_B64" ]; then
+            echo "ERROR: secret KUBECONFIG_TENANT_B64 no configurado en el proyecto Gitea."
+            echo "tenant-manager debe provisionarlo al crear el repo."
+            exit 1
+          fi
+          mkdir -p /root/.kube
+          echo "$KUBECONFIG_B64" | base64 -d > /root/.kube/config
+          chmod 600 /root/.kube/config
+
+      - name: Helm upgrade --install
+        env:
+          TENANT_ID: ${{ vars.TENANT_ID }}
+          TENANT_ID_NODASHES: ${{ vars.TENANT_ID_NODASHES }}
+          TENANT_TIER: ${{ vars.TENANT_TIER }}
+          IMAGE_TAG: ${{ needs.build.outputs.image_tag }}
+        run: |
+          helm upgrade --install __APP_NAME__ ./helm/__APP_NAME__ \
+            --namespace tenant-${TENANT_ID_NODASHES}-apps \
+            --create-namespace \
+            --set image.tag=${IMAGE_TAG} \
+            --set tenantId=${TENANT_ID} \
+            --set tenantIdNodashes=${TENANT_ID_NODASHES} \
+            --set tier=${TENANT_TIER} \
+            --wait --timeout 5m
+
+      - name: Verificar rollout
+        env:
+          TENANT_ID_NODASHES: ${{ vars.TENANT_ID_NODASHES }}
+        run: |
+          kubectl -n tenant-${TENANT_ID_NODASHES}-apps \
+            rollout status deploy/__APP_NAME__ --timeout=3m
+
+      - name: Smoke check post-deploy
+        env:
+          INGRESS_HOST: __APP_NAME__-${{ vars.TENANT_ID_NODASHES }}.apps.coralware.cloud
+        run: |
+          for i in $(seq 1 12); do
+            if wget -q -O - --timeout=10 "https://${INGRESS_HOST}/health" | grep -q '"status":"ok"'; then
+              echo "Smoke OK: /health responde 200"
+              exit 0
+            fi
+            echo "Intento ${i}/12 — /health aún no responde, esperando 5s…"
+            sleep 5
+          done
+          echo "ERROR: /health no respondió 200 dentro del timeout"
+          exit 1