deploy: production compose overlay, nginx vhost and deploy script

Three pieces so kadence.timka.su can be stood up and updated from the repo
rather than from shell history on the box:

* `docker-compose.prod.yml` — publishes the app on loopback only. The base
  file's `${APP_PORT}:8000` binds every interface, which on this host both
  collides with remnawave (already on 8000) and would serve the API beside
  the proxy without TLS. Compose *appends* merged port lists, so the override
  needs the `!override` tag or the public binding survives. uvicorn also gets
  `--proxy-headers`, without which every request looks like plain HTTP from
  127.0.0.1 and the session cookie loses its `Secure` flag.
* `deploy/nginx/kadence.timka.su.conf` — TLS, HSTS, the forwarded headers the
  cookie logic reads, and a 120s read timeout because one task refresh fans
  out to four third-party APIs.
* `deploy/deploy.sh` — idempotent install-or-update. Generates API_TOKEN and
  the database password once and never rotates them afterwards (that would
  lock out the phone and the desktop app), treats `.env.example`'s
  `change-me` placeholders as unset, and uses `certbot certonly --webroot`
  rather than `--nginx` so the vhost in git stays the truth.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/nginx/kadence.timka.su.conf

@@ -0,0 +1,87 @@
+# kadence.timka.su — TLS terminates here; the app listens on loopback only.
+#
+# Installed to /etc/nginx/sites-available/kadence.timka.su by deploy/deploy.sh,
+# which also obtains the certificate. Deliberately *not* managed by
+# `certbot --nginx`: that rewrites the file in place, so the copy in git would
+# stop being the truth. `certbot certonly --webroot` renews the cert and leaves
+# this file alone.
+
+upstream kadence {
+    # Must match KADENCE_BIND in .env (docker-compose.prod.yml publishes it).
+    # 8000 is taken on this host by remnawave, hence 8010.
+    server 127.0.0.1:8010;
+    keepalive 16;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name kadence.timka.su;
+
+    # Renewal has to work over plain HTTP, so this one location stays on :80.
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name kadence.timka.su;
+
+    ssl_certificate     /etc/letsencrypt/live/kadence.timka.su/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/kadence.timka.su/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_session_cache   shared:kadence_tls:10m;
+    ssl_session_timeout 1d;
+    ssl_stapling        on;
+    ssl_stapling_verify on;
+
+    # The session cookie is HttpOnly/SameSite=Lax and the app marks it Secure off
+    # X-Forwarded-Proto below; HSTS is what stops a first request going plain.
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+
+    # The settings page posts secrets (Jira tokens, bot tokens) as JSON; nothing
+    # here is an upload, so a small cap is free protection.
+    client_max_body_size 2m;
+
+    access_log /var/log/nginx/kadence.access.log;
+    error_log  /var/log/nginx/kadence.error.log;
+
+    # Vite fingerprints these, so they can be cached hard and forever.
+    location /assets/ {
+        proxy_pass http://kadence;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header Connection "";
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    location / {
+        proxy_pass http://kadence;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        # This is what makes the login cookie `Secure` — `routes_auth._is_https`
+        # reads it, because the app itself only ever sees plain HTTP on loopback.
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host  $host;
+        proxy_set_header Connection        "";
+
+        # A task refresh fans out to Jira, Todoist, Google and the laundry site in
+        # one request; 60s is the shortest timeout that does not cut it off.
+        proxy_connect_timeout 10s;
+        proxy_send_timeout    120s;
+        proxy_read_timeout    120s;
+    }
+}