Docker deployment (2 images, 3 composes, Tailscale funnels) + committed security suite

Test suite (the manual audit harness, now a real test):
- backend/apps/core/tests/test_security.py: 20 transactional tests across
  guest visibility, object ownership, staged-upload/similarity privacy,
  staff role boundaries, deletion rules, encrypted credentials, throttling
  and the download allowlist. Uses temp media folders and clears cache.
  Needs a one-time GRANT on test_j621 (documented in the module + README).

Images (deploy/J621-Frontend, deploy/J621-Backend, repo root as context):
- Frontend: node build -> static nginx with SPA fallback, asset caching and
  an internal health endpoint.
- Backend: gunicorn + whitenoise (admin static collected at build), ffmpeg
  for video thumbnails, migrations applied on start, GIT_HASH build arg so
  the shell's version pill shows the commit.

Composes (distinct project names so they coexist with the dev stack):
- compose.yml (both), compose.frontend.yml, compose.backend.yml.
- A shared nginx proxy service is the only entry point (no host nginx, no
  published host ports): /api,/admin,/static,/health -> backend, everything
  else -> SPA; both upstreams resolve at request time so one config serves
  all variants.
- A Tailscale sidecar per compose shares the nginx network namespace;
  serve.default/frontend/backend.json use funnel ports 443 and 8443 only
  (10000 is the remaining allowance) with ${TS_CERT_DOMAIN} substitution.

Registry: push_frontend.sh / push_backend.sh / push_all.sh build multi-arch
images and push :latest + :<sha> to the Gitea registry, following the
existing Packs-site pattern.

Docs: deploy/README.md + .env.example, ROADMAP section 6 updated,
AGENTS.md deployment and test notes.

Verified: all three composes validate, both nginx configs pass nginx -t,
both images build, the combined stack boots against real MariaDB/Redis
(migrations applied, /health ok, whitenoise serving admin static, env=prod,
git hash baked in), the proxy serves the SPA and routes /api, and
manage.py test apps.core.tests passes 20/20.

deploy/.env.example

@@ -0,0 +1,67 @@
+# J621 deployment environment — copy to deploy/.env and fill in.
+#
+# Compose reads this file for variable substitution AND passes it to the
+# backend container (env_file), so everything here is visible to Django.
+
+# ---------------------------------------------------------------------------
+# Tailscale
+# ---------------------------------------------------------------------------
+# Reusable, untagged auth key (Settings -> Keys -> Generate auth key,
+# Reusable = on, Tags = none). Auto-approves the device.
+TS_AUTHKEY=
+
+# Hostname this deployment gets on the tailnet; the funnel URL becomes
+# https://<TS_HOSTNAME>.<tailnet>.ts.net. Use distinct names per compose.
+TS_HOSTNAME=j621
+
+# ---------------------------------------------------------------------------
+# Django
+# ---------------------------------------------------------------------------
+# Long random string. Signs media URLs and encrypts stored e621 API keys —
+# rotating it invalidates both, so users re-enter their e621 key.
+SECRET_KEY=change-me-to-a-long-random-string
+DEBUG=False
+
+# Hosts Django may be reached on, comma separated, no scheme. Add the tailnet
+# hostname of every compose that talks to this backend (and keep localhost /
+# 127.0.0.1 for container health checks).
+ALLOWED_HOSTS=j621.rainbow-herring.ts.net,localhost,127.0.0.1
+
+# ---------------------------------------------------------------------------
+# Cross-origin access (needed for the separate frontend + backend deploys)
+# ---------------------------------------------------------------------------
+# The origin the SPA is served from, e.g. https://j621-frontend.<tailnet>.ts.net
+# CORS_ALLOWED_ORIGINS=
+# CSRF_TRUSTED_ORIGINS=
+
+# ---------------------------------------------------------------------------
+# Database (created by the compose files; change the password)
+# ---------------------------------------------------------------------------
+DB_NAME=j621
+DB_USER=j621
+DB_PASSWORD=j621
+DB_ROOT_PASSWORD=j621root
+
+# ---------------------------------------------------------------------------
+# Optional overrides
+# ---------------------------------------------------------------------------
+# GUNICORN_WORKERS=2
+# GUNICORN_THREADS=4
+# GUNICORN_TIMEOUT=120
+
+# Rate limits (per IP anonymous, per account signed in)
+# THROTTLE_ANON=120/min
+# THROTTLE_USER=600/min
+# THROTTLE_LOGIN=5/min
+# THROTTLE_REGISTER=20/hour
+# THROTTLE_E621_PROXY=60/hour
+
+# e621 media hosts the backend may fetch from (downloads, proxies)
+# E621_MEDIA_HOSTS=static1.e621.net,static2.e621.net,static3.e621.net
+
+# Ephemeral similarity-check lifetime in minutes
+# SIMILARITY_TTL_MINUTES=30
+
+# Registry/tag used by the compose files and push scripts
+# J621_REGISTRY=gitea.rainbow-herring.ts.net/jakebreath
+# J621_TAG=latest