feat(sprint-6): Phase 1 — Production deployment infrastructure (IONOS)

- docker-compose.prod.yml: production Docker Compose with health checks, logging, restart policies, resource limits
- deploy/nginx/cannamanage.conf: Nginx reverse proxy with TLS, CSP, security headers, rate limiting
- deploy/.env.production.example: environment template for secrets
- deploy/backup.sh: GPG-encrypted daily/weekly PostgreSQL backup with retention
- deploy/deploy.sh: manual deploy script with health check verification
- .gitea/workflows/deploy.yml: Gitea Actions CI/CD pipeline (test + deploy)
- application-production.properties: Spring Boot production profile (no stacktraces, Swagger disabled, Stripe)
- .gitignore: added .env to prevent accidental secret commits

.gitignore

@@ -12,3 +12,6 @@ target/
 cannamanage-frontend/node_modules/
 cannamanage-frontend/.next/
 cannamanage-frontend/.env.local
+
+# Production secrets (never commit)
+.env