Docker deployment (2 images, 3 composes, Tailscale funnels) + committed security suite

Test suite (the manual audit harness, now a real test):
- backend/apps/core/tests/test_security.py: 20 transactional tests across
  guest visibility, object ownership, staged-upload/similarity privacy,
  staff role boundaries, deletion rules, encrypted credentials, throttling
  and the download allowlist. Uses temp media folders and clears cache.
  Needs a one-time GRANT on test_j621 (documented in the module + README).

Images (deploy/J621-Frontend, deploy/J621-Backend, repo root as context):
- Frontend: node build -> static nginx with SPA fallback, asset caching and
  an internal health endpoint.
- Backend: gunicorn + whitenoise (admin static collected at build), ffmpeg
  for video thumbnails, migrations applied on start, GIT_HASH build arg so
  the shell's version pill shows the commit.

Composes (distinct project names so they coexist with the dev stack):
- compose.yml (both), compose.frontend.yml, compose.backend.yml.
- A shared nginx proxy service is the only entry point (no host nginx, no
  published host ports): /api,/admin,/static,/health -> backend, everything
  else -> SPA; both upstreams resolve at request time so one config serves
  all variants.
- A Tailscale sidecar per compose shares the nginx network namespace;
  serve.default/frontend/backend.json use funnel ports 443 and 8443 only
  (10000 is the remaining allowance) with ${TS_CERT_DOMAIN} substitution.

Registry: push_frontend.sh / push_backend.sh / push_all.sh build multi-arch
images and push :latest + :<sha> to the Gitea registry, following the
existing Packs-site pattern.

Docs: deploy/README.md + .env.example, ROADMAP section 6 updated,
AGENTS.md deployment and test notes.

Verified: all three composes validate, both nginx configs pass nginx -t,
both images build, the combined stack boots against real MariaDB/Redis
(migrations applied, /health ok, whitenoise serving admin static, env=prod,
git hash baked in), the proxy serves the SPA and routes /api, and
manage.py test apps.core.tests passes 20/20.

deploy/nginx-proxy.conf

@@ -0,0 +1,65 @@
+# J621 public entry point (the "nginx" service in the compose files).
+#
+# Routes:
+#   /api, /admin, /static, /health  -> backend:8000  (Django / gunicorn)
+#   everything else                 -> frontend:80   (SPA static files)
+#
+# Both upstreams are variables so the same file works in all three compose
+# variants: with no frontend on the network "/" answers a small JSON hint,
+# with no backend the API paths answer 502 until one is configured via /setup.
+# Nothing is published to the host; the Tailscale sidecar shares this
+# container's network namespace and funnels to 127.0.0.1:80.
+
+resolver 127.0.0.11 valid=10s ipv6=off;
+
+map $http_x_forwarded_proto $j621_forwarded_proto {
+    default $http_x_forwarded_proto;
+    ""      $scheme;
+}
+
+server {
+    listen 80;
+    server_name _;
+
+    location = /nginx-health {
+        access_log off;
+        return 200 "ok\n";
+    }
+
+    location ~ ^/(api|admin|static|health)(/|$) {
+        set $j621_backend http://backend:8000;
+        proxy_pass $j621_backend$request_uri;
+
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Proto $j621_forwarded_proto;
+
+        # Uploads and client-processed files can be large; stream them.
+        client_max_body_size 2048m;
+        proxy_request_buffering off;
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+    }
+
+    location / {
+        set $j621_frontend http://frontend:80;
+        proxy_pass $j621_frontend$request_uri;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Proto $j621_forwarded_proto;
+
+        # Backend-only deployments have no frontend: say so instead of 502.
+        error_page 502 503 504 = @j621_no_frontend;
+    }
+
+    location @j621_no_frontend {
+        default_type application/json;
+        return 200 '{"detail":"J621 API - no frontend is attached to this deployment."}';
+    }
+}