feat(deploy): add the reference deployment Compose project

Implement ADR 0044's reference deployment as a base Compose file plus
overlays, so an installation that already runs a proxy can use the base
alone.

- compose.yaml: api, postgres, object-storage, and the operator-only
  migrate (profile ops, plan by default). No published port. api and
  migrate run init, read-only, tmpfs /tmp, cap_drop ALL,
  no-new-privileges. postgres is only on the internal data network.
- TLS everywhere from one installation-private CA: PostgreSQL TLS 1.3
  only, with pg_hba rejecting every non-TLS connection, and the API on
  verify-full via EKKLESIA_DATABASE_CA (PEM text). SeaweedFS serves S3
  over HTTPS (ADR 0030 requires https in production), trusted by the
  API through NODE_EXTRA_CA_CERTS. No Core change.
- compose.proxy.yaml + Caddyfile.example: Caddy pinned by digest, ACME
  HTTP-01 (DNS-01 documented), routes /, /api/*, /display/*, /assets/*
  to api and refuses everything else; the storage hostname preserves
  Host. The API trusts exactly the proxy's fixed /32 on an edge network
  whose dynamic range excludes the fixed addresses; Caddy overwrites
  X-Forwarded-For and strips caller-supplied forwarding headers.
- compose.tunnel.yaml: cloudflared pinned by digest, token from its own
  env file; Caddy honors CF-Connecting-IP only from its fixed address.
- Four per-service root-owned env files, examples with no values;
  scripts/init-tls.sh (idempotent, never overwrites a key) and
  scripts/gen-secrets.sh (prints only).
- CI: pnpm deploy:config in ci:verify for all three combinations, and a
  deploy-smoke job (scripts/smoke-deploy.sh) proving readiness, the
  Dashboard, signed storage delivery, the client-address chain, initial
  owner sign-in/out, verify-full database TLS, and Doctor through the
  proxy, against disposable services. tests/deploy.test.ts pins the
  structural guarantees.
- ADR 0044 (still Proposed) amended to match: API-to-storage HTTPS,
  DNS-01 needs a custom Caddy build and tunnel-only needs DNS-01, the
  tunnel's origin TLS settings live in the Cloudflare dashboard, port
  80 serves HTTP-01, and secrets are one env file per service.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/scripts/gen-secrets.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+# Prints freshly generated secrets for the reference deployment's env files (ADR 0044). Writes
+# nothing: paste each line into the file named above it, then install that file root-owned with
+# mode 600.
+#
+#   sh deploy/scripts/gen-secrets.sh
+#
+# Every value is URL-safe (hexadecimal), so the database password needs no percent-encoding in
+# DATABASE_URL.
+
+set -eu
+
+command -v openssl >/dev/null 2>&1 || {
+	echo "gen-secrets: openssl is required." >&2
+	exit 69
+}
+
+hex() {
+	openssl rand -hex "$1"
+}
+
+postgres_password=$(hex 24)
+s3_access_key=$(hex 10)
+s3_secret_key=$(hex 32)
+
+cat <<EOF
+# ekklesia.env
+EKKLESIA_IDENTITY_SECRET=$(hex 32)
+DATABASE_URL=postgresql://ekklesia:$postgres_password@postgres:5432/ekklesia
+S3_ACCESS_KEY=$s3_access_key
+S3_SECRET_KEY=$s3_secret_key
+
+# postgres.env
+POSTGRES_PASSWORD=$postgres_password
+
+# object-storage.env
+AWS_ACCESS_KEY_ID=$s3_access_key
+AWS_SECRET_ACCESS_KEY=$s3_secret_key
+EOF