feat(deploy): CI/CD Gitea Actions + stack Docker prod pour xip.kerboul.me

- docker-compose.prod.yml: postgres + redis + backend (bun) + web (nginx single-origin)
- backend/Dockerfile + entrypoint: prisma migrate deploy + seed idempotent au boot
- frontend/Dockerfile: build Vite (VITE_API_URL=https://xip.kerboul.me) servi par nginx
- deploy/nginx.conf: proxy /api + /ws vers le backend, SPA fallback
- .gitea/workflows/deploy.yml: auto-deploy SSH sur push main (runner CT121 -> CT502)
- scripts/deploy.sh: pull + rebuild de la stack
- mode open-bar (XIP_OPEN_BAR): paywall off pour tous en prod, via isFree() centralise

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/deploy.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Pull the latest main and (re)build the XIP stack on the deploy host.
+# Invoked over SSH by the Gitea Actions workflow on every push to main,
+# and runnable by hand on the CT for manual redeploys.
+set -euo pipefail
+
+APP_DIR="${XIP_APP_DIR:-/opt/xip}"
+COMPOSE_FILE="docker-compose.prod.yml"
+ENV_FILE=".env.prod"
+
+cd "$APP_DIR"
+
+echo "==> Fetching latest origin/main…"
+git fetch --all --prune
+git reset --hard origin/main
+
+echo "==> Building + starting the stack…"
+docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d --build --remove-orphans
+
+echo "==> Pruning dangling images…"
+docker image prune -f >/dev/null 2>&1 || true
+
+echo "==> Current state:"
+docker compose -f "$COMPOSE_FILE" ps
+
+echo "==> Deploy complete."