Add production deployment tooling: Nginx, Gitea, prod Dockerfiles

Sets up everything needed to deploy behind Cloudflare with a self-hosted
git server: multi-stage prod Dockerfiles (non-root), docker-compose.prod.yml
(Postgres/Redis with no host ports, Nginx reverse proxy, Gitea with
public-read/admin-write access control), scripts/bootstrap-env.sh to
auto-generate required secrets on first clone, and DEPLOYMENT.md covering
the full runbook. Provider API keys (Anthropic/Brave/NinjaPear/USPTO/
Turnstile) are deliberately kept out of .env in favor of the existing
DB-backed Settings UI, so the public repo stays safe to expose.

Also fixes two bugs only surfaced by live-testing the prod stack: Celery
beat couldn't write its schedule file as a non-root user, and Gitea's
embedded SSH server conflicted with the base image's own sshd on port 22.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/web/app/page.tsx

@@ -48,6 +48,16 @@ export default function LandingPage() {
         <div className="mx-auto flex max-w-6xl items-center justify-between px-6 py-4">
           <span className="text-lg font-semibold tracking-tight text-slate-900">CI&nbsp;Agent</span>
           <nav className="flex items-center gap-3">
+            {process.env.NEXT_PUBLIC_GIT_REPO_URL && (
+              <a
+                href={process.env.NEXT_PUBLIC_GIT_REPO_URL}
+                target="_blank"
+                rel="noopener noreferrer"
+                className="rounded-md px-3 py-2 text-sm font-medium text-slate-700 hover:bg-slate-100"
+              >
+                Git Repository
+              </a>
+            )}
             <Link
               href="/login"
               className="rounded-md px-3 py-2 text-sm font-medium text-slate-700 hover:bg-slate-100"

apps/web/tests/landing-page.test.tsx

@@ -67,4 +67,19 @@ describe("LandingPage", () => {
     );
     expect(screen.queryByText(/local mode/i)).not.toBeInTheDocument();
   });
+
+  it("hides the Git Repository link when no NEXT_PUBLIC_GIT_REPO_URL is configured", () => {
+    renderWithQueryClient(<LandingPage />);
+    expect(screen.queryByRole("link", { name: /git repository/i })).not.toBeInTheDocument();
+  });
+
+  it("shows a Git Repository link opening in a new tab when configured", () => {
+    vi.stubEnv("NEXT_PUBLIC_GIT_REPO_URL", "https://git.ciagent.org/admin/ci-agent");
+    renderWithQueryClient(<LandingPage />);
+
+    const link = screen.getByRole("link", { name: /git repository/i });
+    expect(link).toHaveAttribute("href", "https://git.ciagent.org/admin/ci-agent");
+    expect(link).toHaveAttribute("target", "_blank");
+    expect(link).toHaveAttribute("rel", "noopener noreferrer");
+  });
 });