feat: poblar scaffold inicial del shape rest-api/python

Reemplaza el placeholder mínimo previo por el scaffold canónico del
golden path rest-api/python (entry point para tier free-trial):

- code/app/main.py — FastAPI con /health (sin DB), /metrics, middleware
  correlation_id, settings Pydantic
- code/tests/ — pytest + httpx TestClient (sin testcontainers, sin Docker)
- helm/APP_NAME/ — chart minimal: Deployment, Service, IngressRoute,
  NetworkPolicy. SIN Job Alembic, SIN ServiceMonitor, SIN claim de BD
- coralware-shape.yaml — shapeVersion 1.0.0, minTier free-trial,
  promotionPath -> web-backend-python cuando se requiera persistencia
- .gitea/workflows/APP_NAME-build.yaml — invoca reusable workflow ADR-038
  + job helm-deploy con KUBECONFIG_TENANT_B64

Diferencias con web-backend/python: sin alembic, sin BD, sin
testcontainers, NetworkPolicy sin acceso a ns-addons.

Placeholders __APP_NAME__, __TIER__, __TENANT_ID__, __TENANT_ID_NODASHES__
serán sustituidos server-side por repo-provisioner.

El openspec/ del golden path NO se sincroniza al repo Gitea (gobernanza
interna de Coralware).

Refs: ADR-027 (Golden Paths), ADR-038 (CI), ADR-053 (referencia anatomía).

helm/APP_NAME/values.yaml

@@ -0,0 +1,52 @@
+# Defaults sensatos para tier free-trial. El CI inyecta tier/tenantId via --set
+# leyendo valores del TenantProfile correspondiente.
+
+replicaCount: 1
+
+image:
+  repository: registry.coralsafety.com/__TENANT_ID_NODASHES__/__APP_NAME__
+  tag: latest
+  pullPolicy: Always
+  pullSecret: harbor-tenant-pull
+
+# Identidad del tenant — populated por --set desde el CI
+tenantId: ""
+tenantIdNodashes: ""
+tier: free-trial
+goldenPath: rest-api
+goldenPathLang: python
+
+config:
+  logLevel: INFO
+  correlationIdHeader: X-Correlation-ID
+  openapiRequireAuth: false
+  keycloakIssuer: ""
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 64Mi
+  limits:
+    cpu: 250m
+    memory: 256Mi
+
+probes:
+  liveness:
+    initialDelaySeconds: 15
+    periodSeconds: 10
+  readiness:
+    initialDelaySeconds: 3
+    periodSeconds: 5
+    failureThreshold: 3
+
+service:
+  type: ClusterIP
+  port: 8000
+
+ingress:
+  enabled: true
+  host: __APP_NAME__-__TENANT_ID_NODASHES__.apps.coralware.cloud
+  tlsSecretName: __APP_NAME__-tls
+
+networkPolicy:
+  enabled: true