Docker deployment (2 images, 3 composes, Tailscale funnels) + committed security suite

Test suite (the manual audit harness, now a real test):
- backend/apps/core/tests/test_security.py: 20 transactional tests across
  guest visibility, object ownership, staged-upload/similarity privacy,
  staff role boundaries, deletion rules, encrypted credentials, throttling
  and the download allowlist. Uses temp media folders and clears cache.
  Needs a one-time GRANT on test_j621 (documented in the module + README).

Images (deploy/J621-Frontend, deploy/J621-Backend, repo root as context):
- Frontend: node build -> static nginx with SPA fallback, asset caching and
  an internal health endpoint.
- Backend: gunicorn + whitenoise (admin static collected at build), ffmpeg
  for video thumbnails, migrations applied on start, GIT_HASH build arg so
  the shell's version pill shows the commit.

Composes (distinct project names so they coexist with the dev stack):
- compose.yml (both), compose.frontend.yml, compose.backend.yml.
- A shared nginx proxy service is the only entry point (no host nginx, no
  published host ports): /api,/admin,/static,/health -> backend, everything
  else -> SPA; both upstreams resolve at request time so one config serves
  all variants.
- A Tailscale sidecar per compose shares the nginx network namespace;
  serve.default/frontend/backend.json use funnel ports 443 and 8443 only
  (10000 is the remaining allowance) with ${TS_CERT_DOMAIN} substitution.

Registry: push_frontend.sh / push_backend.sh / push_all.sh build multi-arch
images and push :latest + :<sha> to the Gitea registry, following the
existing Packs-site pattern.

Docs: deploy/README.md + .env.example, ROADMAP section 6 updated,
AGENTS.md deployment and test notes.

Verified: all three composes validate, both nginx configs pass nginx -t,
both images build, the combined stack boots against real MariaDB/Redis
(migrations applied, /health ok, whitenoise serving admin static, env=prod,
git hash baked in), the proxy serves the SPA and routes /api, and
manage.py test apps.core.tests passes 20/20.

deploy/push_backend.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# Build and push the J621 backend image (amd64 + arm64) to the private Gitea
+# registry as :latest and :<commit-sha>.
+#
+# Usage: ./push_backend.sh [commit-sha]
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+REGISTRY="gitea.rainbow-herring.ts.net/jakebreath/j621-backend"
+REGISTRY_HOST="$(printf '%s' "$REGISTRY" | cut -d/ -f1)"
+SHA="${1:-$(git rev-parse --short HEAD)}"
+BUILDER=multiarch
+PLATFORMS="linux/amd64,linux/arm64"
+
+echo "==> Logging in to $REGISTRY_HOST ..."
+docker login "$REGISTRY_HOST"
+
+if ! docker buildx inspect "$BUILDER" >/dev/null 2>&1; then
+    echo "==> Creating buildx builder '$BUILDER' ..."
+    docker buildx create --name "$BUILDER" --driver docker-container \
+        --platform "$PLATFORMS" --bootstrap
+else
+    docker buildx inspect --bootstrap "$BUILDER" >/dev/null
+fi
+
+echo "==> Building + pushing $PLATFORMS -> $REGISTRY:{latest,$SHA} ..."
+docker buildx build --builder "$BUILDER" --push \
+    --platform "$PLATFORMS" \
+    --build-arg "GIT_HASH=$SHA" \
+    -f deploy/J621-Backend \
+    -t "$REGISTRY:latest" \
+    -t "$REGISTRY:$SHA" \
+    .
+
+echo "==> Done. On the deploy host:"
+echo "    docker login $REGISTRY_HOST && docker compose pull && docker compose up -d"