Add registry-based prod promotion, separate from auto dev deploy

Dev keeps auto-deploying on every push to main, same as before, but now
also publishes each build to git.jerodrigged.com's container registry
tagged by short commit SHA (best-effort - never blocks the dev deploy
if REGISTRY_TOKEN isn't set yet).

Prod deploys only on an intentional `git push origin main:prod`, and
only ever pulls a pre-built SHA-tagged image - it never rebuilds from
source. This guarantees prod runs the exact artifact dev already
validated, and makes promoting an untested commit fail loudly (pull of
a nonexistent tag) instead of silently rebuilding something new.

Needs new secrets before the prod path works: PROD_SSH_KEY, PROD_HOST,
PROD_USER, REGISTRY_USER, REGISTRY_TOKEN. PROD_SSH_KEY/PROD_HOST/
REGISTRY_USER are already set; PROD_USER and REGISTRY_TOKEN still need
Jerod's input.

docker-compose.deploy.yml

@@ -0,0 +1,13 @@
+# Prod-only override. Used exclusively by .gitea/workflows/deploy-prod.yml as:
+#   docker compose -f docker-compose.yml -f docker-compose.deploy.yml pull
+#   docker compose -f docker-compose.yml -f docker-compose.deploy.yml up -d
+#
+# Overriding `image:` here means `pull` fetches a specific pre-built tag from
+# the registry and `up -d` runs it without ever invoking `build:` — prod can
+# only ever run an artifact that dev already built and published under
+# IMAGE_TAG (the short commit SHA). See CLAUDE.md CI/CD section.
+services:
+  portfolio:
+    image: git.jerodrigged.com/jhodgkin/lisilou-portfolio-web:${IMAGE_TAG}
+  api:
+    image: git.jerodrigged.com/jhodgkin/lisilou-portfolio-api:${IMAGE_TAG}