feat: add CI/CD pipeline, production Dockerfile, and deployment architecture

- Add production Dockerfile with bun build --compile, multi-stage Alpine build
- Add .dockerignore
- Swap bcrypt -> bcryptjs (pure JS, no native addons)
- Add programmatic migrations on startup via drizzle migrator
- Add /v1/version endpoint with APP_VERSION baked in at build time
- Add .gitea/workflows/ci.yml (lint + test with postgres/valkey services)
- Add .gitea/workflows/build.yml (version bump, build, push to registry)
- Update CLAUDE.md and docs/architecture.md to remove multi-tenancy
- Add docs/deployment.md covering DOKS + ArgoCD architecture

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,32 @@
+FROM oven/bun:1.3.11-alpine AS deps
+WORKDIR /app
+COPY package.json bun.lock ./
+COPY packages/shared/package.json packages/shared/
+COPY packages/backend/package.json packages/backend/
+RUN bun install --frozen-lockfile
+
+FROM oven/bun:1.3.11-alpine AS build
+ARG APP_VERSION=dev
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=deps /app/packages/shared/node_modules ./packages/shared/node_modules
+COPY --from=deps /app/packages/backend/node_modules ./packages/backend/node_modules
+COPY packages/shared ./packages/shared
+COPY packages/backend ./packages/backend
+COPY package.json ./
+COPY tsconfig.base.json ./
+WORKDIR /app/packages/backend
+RUN bun build src/main.ts --compile --outfile /app/server \
+  --define "process.env.APP_VERSION='${APP_VERSION}'"
+
+FROM alpine:3.21
+RUN addgroup -S app && adduser -S app -G app
+WORKDIR /app
+COPY --from=build /app/server ./server
+COPY --from=build /app/packages/backend/src/db/migrations ./migrations
+ENV MIGRATIONS_DIR=/app/migrations
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD wget -qO- http://localhost:8000/v1/health || exit 1
+USER app
+CMD ["./server"]