feat(deploy): CI/CD Gitea Actions + stack Docker prod pour xip.kerboul.me

- docker-compose.prod.yml: postgres + redis + backend (bun) + web (nginx single-origin)
- backend/Dockerfile + entrypoint: prisma migrate deploy + seed idempotent au boot
- frontend/Dockerfile: build Vite (VITE_API_URL=https://xip.kerboul.me) servi par nginx
- deploy/nginx.conf: proxy /api + /ws vers le backend, SPA fallback
- .gitea/workflows/deploy.yml: auto-deploy SSH sur push main (runner CT121 -> CT502)
- scripts/deploy.sh: pull + rebuild de la stack
- mode open-bar (XIP_OPEN_BAR): paywall off pour tous en prod, via isFree() centralise

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/src/lib/catalog.ts

@@ -1,6 +1,6 @@
 import { prisma } from "./prisma";
 import { spend, getWallet, InsufficientCreditsError } from "./wallet";
-import { isLocalhost } from "./ip";
+import { isFree } from "./ip";
 import { invalidatePerks, getPerksForIp } from "./perks";
 
 /**
@@ -105,7 +105,7 @@ export async function purchase(
   const product = await getProduct(productId);
   if (!product || !product.active) throw new PurchaseError("Produit introuvable", 404);
 
-  const free = isLocalhost(ip);
+  const free = isFree(ip);
   const price = effectivePrice(product, options);
 
   // Resolve which entitlement kind(s) this grants + per-IP limit checks.