feat(mapache): add live signal-streaming service

[BK1031]

mapache v3.5.0 extracted the WebSocket / SSE signal-streaming endpoints out of gr26 into a new `live` service (Mapache commits `1eeafd2`, `22102fa`). Live subscribes to the `query/live/#` republish topic without the shared-sub prefix, so every replica sees every signal — which closes the dashboard partial-visibility gap we hit while gr26 was on shared subscriptions with a local-only Hub.

What's in the PR

File	Change
`live.yaml` (new)	Deployment + Service on `:7015`, replicas=2 with the same `minDomains=2 / maxSkew=1` topology spread pattern. env wires `MQTT_USER=mapache` + `MQTT_PASSWORD` from `mapache-secrets`, `CACHE_WINDOW_SEC=60`.
`kustomization.yaml`	`live.yaml` added to resources; live image pinned at `3.5.0`. The Mapache `deploy.yml` awk already includes `live` in its rewrite pattern, so future releases auto-bump alongside the other services.
`configmap-kerbecs.yaml`	New `live` upstream + 3 routes — `live-ws` (passthrough), `live-sse` (passthrough), `live` catch-all (default envelope for `/live/ping` + `/live/stats`). Routes ordered before the dashboard catch-all so they match first.

Endpoints after this lands

• `wss://mapache.gauchoracing.com/api/live/ws?vehicle_id=gr26&signals=*&backfill=30&rate=10` — WebSocket stream
• `https://mapache.gauchoracing.com/api/live/sse?...\` — Server-sent events
• `https://mapache.gauchoracing.com/api/live/ping\` — health
• `https://mapache.gauchoracing.com/api/live/stats\` — cache + connection metrics

Cache caveat

The `CACHE_WINDOW_SEC=60` ring buffer is per-pod, in-memory. A pod restart drops its cache, and clients that reconnect onto another pod see only that pod's cache for the first 60s. Acceptable for the dashboard use case; promotable to Redis if we ever need cross-pod consistency.

Test plan

• `kubectl kustomize . | kubectl apply --dry-run=client` succeeds; dry-run shows `deployment.apps/live created`
• `mapache-secrets.MQTT_PASSWORD` already holds the mapache user's password (set out-of-band for PR chore(gr26): swap MQTT auth from gr26 user → mapache fleet user #73)
• After ArgoCD sync: `kubectl -n mapache get deploy live` shows `READY 2/2`
• `kubectl -n mapache logs deploy/live | grep '[MQ] Connected'` — both pods connect cleanly
• `curl https://mapache.gauchoracing.com/api/live/ping\` returns 200
• `wscat -c "wss://mapache.gauchoracing.com/api/live/ws?vehicle_id=gr26&signals=ecu_vehicle_speed,tcm_cpu_temp&backfill=10&rate=5"` — receives a backfill message then live updates for both an ECU and a TCM signal (proves the cross-replica visibility fix)