Add deploy/ — nginx vhost, systemd unit, runbook

Single-host deployment of the app at rfc.wiggleverse.org alongside
the existing Gitea instance. nginx reverse-proxies /api/* and
/auth/* to a single uvicorn process on 127.0.0.1:8000 and serves
the Vite build output as static files; certbot adds the TLS cert
in place; systemd supervises the process per §4.2's
single-process-with-WAL-SQLite contract (one worker; raising
--workers would break the invariant).

deploy/DEPLOY.md is the step-by-step runbook covering host prep,
Gitea bot + OAuth setup, .env shape, meta-repo seed, nginx +
certbot, systemd, smoke test, and the update/rollback shape.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -215,3 +215,5 @@ surface at `/rfc/<slug>` then has something real to render.
   The spec's decisions answer to it.
 - [`docs/DEV.md`](./docs/DEV.md) — the build's slicing plan, the
   current state, and the next slice's brief.
+- [`deploy/DEPLOY.md`](./deploy/DEPLOY.md) — single-host production
+  deployment behind nginx + Let's Encrypt.