Stage 16: deploy infra & test contour

- backend + gateway multi-stage distroless Dockerfiles; the gateway embeds and
  serves the SPA at / and /telegram/ via go:embed (committed dist placeholder,
  real build baked in by the image's node stage)
- deploy/docker-compose.yml: backend + gateway + Postgres + Telegram connector
  (VPN sidecar) + OTel Collector + Prometheus (15d) + Tempo (72h) + Grafana,
  fronted by a caddy owning a single /_gm Basic-Auth (admin console + Grafana
  subpath); inter-service on a private network, only caddy on the edge network
- new metrics: backend accounts_created_total{kind} (robots excluded) and an
  in-memory gateway active_users{window=24h,7d} gauge
- CI: single .gitea/workflows/ci.yaml (unit/integration/ui + a gated test-contour
  deploy) on the new feature/* -> development -> master branch model; the old
  go-unit/integration/ui-test workflows are folded in; the connector-scoped
  compose is retired (superseded by deploy/)
- docs: ARCHITECTURE §11/§12/§13, root + gateway READMEs, CLAUDE.md branching,
  PLAN.md (stage 16 done + refinements + Stage 17 forward-notes)

README.md

@@ -80,3 +80,24 @@ pnpm dev       # against a running gateway (Vite proxies the RPC path to :8081)
 `pnpm check` (type-check), `pnpm test:unit` (Vitest), `pnpm test:e2e` (Playwright
 smoke vs the mock), `pnpm build` (static bundle). Details — including the committed
 edge codegen (`pnpm codegen`) — are in [`ui/README.md`](ui/README.md).
+
+## Deploy (`deploy/`)
+
+The full contour is [`deploy/docker-compose.yml`](deploy/docker-compose.yml):
+`backend` + `gateway` (with the UI embedded via `go:embed`, baked in by its node
+build stage) + Postgres + the Telegram connector (with a VPN sidecar) + an
+observability stack (OTel Collector → Prometheus + Tempo → Grafana) + a front
+**caddy** that owns a single `/_gm` Basic-Auth (admin console + Grafana). The Go
+services build from multi-stage distroless `*/Dockerfile`.
+
+```sh
+docker build -f backend/Dockerfile -t scrabble-backend .   # pulls the DAWG release artifact
+docker build -f gateway/Dockerfile -t scrabble-gateway .   # node stage builds + embeds the UI
+docker compose -f deploy/docker-compose.yml config         # validate (needs the TEST_/PROD_ env)
+```
+
+CI auto-deploys the **test contour** on a PR into — or push to — `development`
+(`.gitea/workflows/ci.yaml`); the **prod contour** is a manual deploy after
+`development → master` (Stage 17). Env reference: [`deploy/.env.example`](deploy/.env.example);
+the topology and the two-contour model are in
+[`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) §13.