Add production CI/CD deployment pipeline

Add GHCR image build/push and SSH-based server deployment workflow, production compose/env templates, and deployment script. Also fix frontend container healthcheck target and extend Docker CI with frontend health verification.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

devops/scripts/deploy-prod.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+require_env() {
+  local name="$1"
+  if [[ -z "${!name:-}" ]]; then
+    echo "Missing required environment variable: $name" >&2
+    exit 1
+  fi
+}
+
+require_env "GHCR_USERNAME"
+require_env "GHCR_READ_TOKEN"
+require_env "GHCR_OWNER"
+require_env "IMAGE_TAG"
+
+if [[ ! -f ".env" ]]; then
+  echo "Missing .env in deployment directory. Create it from devops/.env.production.example." >&2
+  exit 1
+fi
+
+echo "${GHCR_READ_TOKEN}" | docker login ghcr.io -u "${GHCR_USERNAME}" --password-stdin
+
+IMAGE_TAG="${IMAGE_TAG}" GHCR_OWNER="${GHCR_OWNER}" docker compose -f docker-compose.prod.yml --env-file .env pull
+IMAGE_TAG="${IMAGE_TAG}" GHCR_OWNER="${GHCR_OWNER}" docker compose -f docker-compose.prod.yml --env-file .env up -d --remove-orphans
+
+docker compose -f docker-compose.prod.yml --env-file .env ps