feat(deploy): visible prod-deploy jobs + manual prod-rollback

- prod-deploy.yaml is now four visible sequential jobs (build -> deploy-main ->
  deploy-bot -> verify) so the rollout stages show in the Actions UI; the
  per-service rolling stays in the deploy-main log.
- prod-rollback.yaml: a separate manual workflow_dispatch. Leave target_version
  blank to roll back to the previous deployed version (the host now tracks
  DEPLOYED_TAG + PREVIOUS_TAG), or pick a release tag. Re-deploys an already
  published image rolling + health-gated, image-only (no rebuild, no DB migration).
- prod-deploy.sh tracks the previous tag (commit_tag) for the blank-input rollback.
- Docs: ARCHITECTURE §13 + deploy/README runbook cover versioning + rollback.

deploy/prod-deploy.sh

@@ -36,6 +36,9 @@ MIGRATION="${MIGRATION:-0}"
 COMPOSE_DIR="${COMPOSE_DIR:-/opt/scrabble/compose}"
 DUMP_DIR="${DUMP_DIR:-/opt/scrabble/dumps}"
 STATE_FILE="${STATE_FILE:-/opt/scrabble/DEPLOYED_TAG}"
+# The prior deployed tag, preserved on every successful deploy so prod-rollback can
+# target "the previous version" with no operator input.
+PREV_STATE_FILE="${PREV_STATE_FILE:-/opt/scrabble/PREVIOUS_TAG}"
 PG_USER="${POSTGRES_USER:-scrabble}"
 PG_DB="${POSTGRES_DB:-scrabble}"
 
@@ -88,6 +91,12 @@ rollback() {
   [ "$MIGRATION" = 1 ] && echo "NOTE: the DB is forward-migrated; a pre-deploy dump is in $DUMP_DIR — restore manually ONLY if the migration was destructive (see deploy/README.md, prod runbook)."
 }
 
+commit_tag() {
+  # Record the just-deployed tag as current, preserving the prior one as previous.
+  [ -f "$STATE_FILE" ] && cp "$STATE_FILE" "$PREV_STATE_FILE"
+  echo "$TAG" > "$STATE_FILE"
+}
+
 mkdir -p "$DUMP_DIR"
 echo "=== prod deploy: tag=$TAG prev=$PREV_TAG migration=$MIGRATION ==="
 use_tag "$TAG"
@@ -99,7 +108,7 @@ if [ -z "$(docker ps -aq -f name=scrabble-backend)" ]; then
   dc up -d --no-build --remove-orphans || { echo "compose up failed"; exit 1; }
   health_backend || { echo "backend not ready"; exit 1; }
   health_landing || { echo "landing not ready"; exit 1; }
-  echo "$TAG" > "$STATE_FILE"
+  commit_tag
   echo "first deploy healthy ($TAG)."
   exit 0
 fi
@@ -130,5 +139,5 @@ dc up -d --no-build --remove-orphans || { rollback; exit 1; }
 
 # Final internal sanity before committing the new tag.
 health_backend || { rollback; exit 1; }
-echo "$TAG" > "$STATE_FILE"
+commit_tag
 echo "=== deploy healthy ($TAG) ==="