unify k8s naming: drop be/fe split, single switchboard deployment

- k8s/backend.yaml → k8s/switchboard.yaml (already renamed)
- Deployment/Service name: switchboard-be → switchboard
- Removed component:backend labels (single image, no component split)
- Ingress: all paths route to switchboard service on :8080
- CI: updated manifest render, apply, and rollout references
- Removed stale extractor sidecar and extraction env vars
- Updated CHANGELOG and ROADMAP with CI fixes and design decisions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ROADMAP.md

@@ -6,6 +6,16 @@ Fork of chat-switchboard, gutted to a pure extension platform. All AI/chat
 features removed from the kernel. What remains is the minimum viable
 platform that extensions build on.
 
+### Retained kernel capabilities
+
+- **Auth**: builtin (simple), mTLS, OIDC
+- **Identity**: users, teams, groups, permissions (RBAC)
+- **Packages**: surfaces, extensions, libraries, workflows
+- **Starlark sandbox**: capability-gated modules
+- **Storage**: object storage (PVC, S3), ext_data tables
+- **Realtime**: WebSocket hub, presence, multi-replica HA
+- **Ops**: audit log, notifications, maintenance goroutine
+
 ### Phase 0 (in progress)
 
 | Step | Status | Description |
@@ -18,8 +28,8 @@ platform that extensions build on.
 | 6. Fix tests | ✅ | 8 test packages pass, ~12K stale test lines pruned |
 | 7. Frontend gut | ✅ | Shell + SDK only, 50+ files of chat/notes/projects code removed |
 | 8. New ICD | 🔧 | Stub in place, full kernel-only spec TBD |
-| 9. CI/CD + Dockerfile | ✅ | Single unified image, FE/BE split removed, DB names updated |
-| 10. Smoke test + tag | ⬜ | Deploy, verify, tag v0.1.0 |
+| 9. CI/CD + Dockerfile | ✅ | Single unified image, FE/BE split removed, DB names updated, k8s var alignment fixes (resource quantities, image name, rollout deployment name) |
+| 10. Smoke test + tag | 🔧 | Deploy passes CI, verify health + ingress routing, tag v0.1.0 |
 
 ## v0.2.0 — SDK & Triggers
 
@@ -33,6 +43,14 @@ SDK stabilization, and the first rebuilt extension (tasks).
 - **Theme tokens** exposed to extensions
 - **Task extension**: first proof-of-concept — full task system rebuilt as a
   Starlark extension using triggers + ext_data + notifications
+- **Settings override model**: RBAC controls scope auth (admin → global,
+  team-admin → team, user → personal). `user_overridable` flag on each setting
+  controls whether lower scopes can override higher. Resolution order:
+  user → team → global (first non-null wins, walking up if overridable).
+  Extension manifests declare `user_overridable` per setting key.
+- **Default surface routing**: `/` redirects to configurable default surface.
+  No surfaces installed → admin surface is default. First surface installed
+  becomes default. Changeable in admin settings.
 
 ## v0.3.0 — Editor Surface