feat(deploy): add the reference deployment Compose project

Implement ADR 0044's reference deployment as a base Compose file plus
overlays, so an installation that already runs a proxy can use the base
alone.

- compose.yaml: api, postgres, object-storage, and the operator-only
  migrate (profile ops, plan by default). No published port. api and
  migrate run init, read-only, tmpfs /tmp, cap_drop ALL,
  no-new-privileges. postgres is only on the internal data network.
- TLS everywhere from one installation-private CA: PostgreSQL TLS 1.3
  only, with pg_hba rejecting every non-TLS connection, and the API on
  verify-full via EKKLESIA_DATABASE_CA (PEM text). SeaweedFS serves S3
  over HTTPS (ADR 0030 requires https in production), trusted by the
  API through NODE_EXTRA_CA_CERTS. No Core change.
- compose.proxy.yaml + Caddyfile.example: Caddy pinned by digest, ACME
  HTTP-01 (DNS-01 documented), routes /, /api/*, /display/*, /assets/*
  to api and refuses everything else; the storage hostname preserves
  Host. The API trusts exactly the proxy's fixed /32 on an edge network
  whose dynamic range excludes the fixed addresses; Caddy overwrites
  X-Forwarded-For and strips caller-supplied forwarding headers.
- compose.tunnel.yaml: cloudflared pinned by digest, token from its own
  env file; Caddy honors CF-Connecting-IP only from its fixed address.
- Four per-service root-owned env files, examples with no values;
  scripts/init-tls.sh (idempotent, never overwrites a key) and
  scripts/gen-secrets.sh (prints only).
- CI: pnpm deploy:config in ci:verify for all three combinations, and a
  deploy-smoke job (scripts/smoke-deploy.sh) proving readiness, the
  Dashboard, signed storage delivery, the client-address chain, initial
  owner sign-in/out, verify-full database TLS, and Doctor through the
  proxy, against disposable services. tests/deploy.test.ts pins the
  structural guarantees.
- ADR 0044 (still Proposed) amended to match: API-to-storage HTTPS,
  DNS-01 needs a custom Caddy build and tunnel-only needs DNS-01, the
  tunnel's origin TLS settings live in the Cloudflare dashboard, port
  80 serves HTTP-01, and secrets are one env file per service.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/check-deploy-config.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Validates the reference deployment's Compose files (ADR 0044) in each supported combination:
+# base, base + proxy, and base + proxy + tunnel. Uses only the committed example env files, copied
+# to a temporary directory, so it needs no secret and starts nothing.
+
+set -Eeuo pipefail
+
+repository_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repository_root/deploy"
+
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+for name in ekklesia postgres object-storage tunnel; do
+  cp "env/${name}.env.example" "$work/${name}.env"
+done
+cp env/compose.env.example "$work/compose.env"
+cat >>"$work/compose.env" <<EOF_ENV
+EKKLESIA_IMAGE=registry.example.org/ekklesia:0.0.0
+EKKLESIA_ENV_DIR=${work}
+EKKLESIA_HOSTNAME=ekklesia.example.org
+EKKLESIA_STORAGE_HOSTNAME=storage.ekklesia.example.org
+[email protected]
+EOF_ENV
+
+combinations=(
+  "compose.yaml"
+  "compose.yaml compose.proxy.yaml"
+  "compose.yaml compose.proxy.yaml compose.tunnel.yaml"
+)
+for combination in "${combinations[@]}"; do
+  arguments=()
+  for file in $combination; do
+    arguments+=(--file "$file")
+  done
+  if ! docker compose --env-file "$work/compose.env" "${arguments[@]}" --profile ops config --quiet; then
+    echo "Reference deployment Compose configuration is invalid: ${combination}" >&2
+    exit 1
+  fi
+  echo "valid: ${combination}"
+done