fix: remove full host filesystem hostPath mount from web deployment

[hacktron-app-stg]

Vulnerability

deployment.yaml mounted the entire host root filesystem into the web container:

volumeMounts:
  - name: host-root
    mountPath: /host
volumes:
  - name: host-root
    hostPath:
      path: /

A hostPath volume with path: / gives the container read/write access to every file on the underlying node — kernel/config/secrets, other containers' data, kubelet credentials, etc. Combined with the container's privileged settings this allows trivial full host compromise. Severity: critical.

Fix

Removed the host-root hostPath volume and its volumeMount. The mount was not referenced by any application code or configuration, so it can be dropped safely without a functional replacement.

Verification

• Confirmed no other manifest or code references the host-root volume or /host mount path.
• Verified the resulting deployment.yaml is structurally intact YAML (the containers list now terminates at the env block; no dangling volumeMounts/volumes keys remain).

Note: this PR intentionally addresses only the reported "Full Host Filesystem Mount" finding. Other insecure settings present in the manifest (privileged, hostNetwork/hostPID, runAsUser 0, hardcoded secret, :latest image) are separate findings and out of scope for this change.

---

Automated fix by Hacktron for finding: https://staging.hacktron.ai/testestesttest/findings/357b40ea-46a3-453e-9e47-51829fca59e4