feat(deploy): add full CD pipeline infrastructure for DeepDrftHome

Four Gitea workflows (deploy-public, deploy-manager, deploy-api,
package-install) and a complete deploy/ folder: bootstrap, install,
ssh-wrapper, three deploy scripts, setup-step10-creds, three systemd
user units, two nginx vhost templates. Models Skipper's deploy
infrastructure with key deviations: flat csproj paths, dual PostgreSQL
databases, FileDatabase vault directory (never touched on deploy), EF
bundle covers DeepDrftContext only (AuthBlocks self-migrates at boot),
deploy-api reads DB connection from host credentials not CI args.

deploy/systemd/deepdrftpublic.service

@@ -0,0 +1,30 @@
+[Unit]
+Description=DeepDrft Public Site — Blazor SSR + WASM public listener site
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+Restart=always
+RestartSec=5
+
+WorkingDirectory=%h/public/bin
+ExecStart=%h/public/bin/DeepDrftPublic
+
+# Non-secret config — hardcoded; no plaintext file needed.
+Environment=ASPNETCORE_ENVIRONMENT=Production
+Environment=ASPNETCORE_URLS=http://localhost:5000
+
+# Secrets — loaded at startup into $CREDENTIALS_DIRECTORY/.
+# File lives at %h/.config/credentials/ (deepdrft:deepdrft 600).
+# LoadCredential id 'api' must match CredentialTools.ResolvePathOrThrow("api", ...) key.
+LoadCredential=api:%h/.config/credentials/api-public.json
+
+# Forward headers are configured in Program.cs for the nginx proxy topology.
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=deepdrftpublic
+
+[Install]
+WantedBy=default.target