Add production deployment tooling: Nginx, Gitea, prod Dockerfiles

Sets up everything needed to deploy behind Cloudflare with a self-hosted
git server: multi-stage prod Dockerfiles (non-root), docker-compose.prod.yml
(Postgres/Redis with no host ports, Nginx reverse proxy, Gitea with
public-read/admin-write access control), scripts/bootstrap-env.sh to
auto-generate required secrets on first clone, and DEPLOYMENT.md covering
the full runbook. Provider API keys (Anthropic/Brave/NinjaPear/USPTO/
Turnstile) are deliberately kept out of .env in favor of the existing
DB-backed Settings UI, so the public repo stays safe to expose.

Also fixes two bugs only surfaced by live-testing the prod stack: Celery
beat couldn't write its schedule file as a non-root user, and Gitea's
embedded SSH server conflicted with the base image's own sshd on port 22.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

.dockerignore

@@ -0,0 +1,45 @@
+# Docker's ignore-pattern matching is NOT recursive-by-default the way
+# .gitignore's is - a bare `node_modules/` only matches a top-level
+# directory of that name, not apps/web/node_modules. Every pattern below
+# is prefixed with **/ so it matches at any depth (confirmed by testing:
+# without **/, `apps/web/node_modules` alone still uploaded ~600MB of
+# build context that was never actually needed by any Dockerfile).
+
+**/.git/
+**/.env
+**/.env.local
+**/*.pem
+**/*.key
+
+**/__pycache__/
+**/*.py[cod]
+**/*.egg-info/
+**/.venv/
+**/venv/
+**/.pytest_cache/
+**/.ruff_cache/
+**/.mypy_cache/
+**/htmlcov/
+**/.coverage
+**/*.db
+**/*.sqlite3
+
+**/node_modules/
+**/.next/
+**/out/
+**/dist/
+**/build/
+**/.turbo/
+**/coverage/
+**/*.tsbuildinfo
+**/.eslintcache
+
+**/test-results/
+**/playwright-report/
+**/playwright/.cache/
+
+**/.claude/
+**/.vscode/
+**/.idea/
+**/*.log
+**/logs/