ci: deployment stack, CI/CD pipelines and observability-ready backend - #35

…onflict

…ctions

…nvitationsPanel components

…d state

…uard getInvitations 403

…subtle delete

- Replace flat outline buttons with full-width clickable rows (icon + label + arrow)
- Add colour-coded avatar circle derived deterministically from group slug
- Move delete action to a discrete icon button (only visible on hover)
- Show date range as a GlassChip instead of plain text
- Fix hydration mismatch by passing explicit fr-FR locale to toLocaleDateString

- install.sh: bootstrap (Docker, ufw, fail2ban), generates .env with
  random secrets, builds the stack and waits for backend health
- Caddyfile: reverse proxy with automatic HTTPS, domain from DOMAIN env
- docker-compose.prod.yml: production overlay running Caddy on 80/443
- docker-compose.yml: bind app ports to 127.0.0.1 (only Caddy is public)
- .gitignore: ignore per-instance config/
- .gitattributes: enforce LF line endings

- ask(): always return 0 (a non-empty answer with no default made the
  trailing test return non-zero, which set -e turned into an exit)
- create .env only after all prompts succeed (no half-written file)

- update.sh: pull, rebuild, health-check; on failure rolls back code
  and restores the pre-update database dump. Flags: --yes, --no-backup.
  Single-instance lock; keeps the last 7 DB backups.
- deploy/systemd: optional service + timer for scheduled local updates
- .gitignore: ignore /backups/

- add micrometer-registry-prometheus; expose health, info, prometheus
- enable liveness/readiness health probes
- logback-spring.xml: console logs in dev, JSON logs in prod (Loki-ready)
- permit /actuator/info and /actuator/prometheus (internal network only)
- add JaCoCo plugin for coverage reports

- ci.yml: paths-filtered jobs on dev/main (push + PR), concurrency cancel
  - frontend: lint, typecheck, build
  - backend: compile, verify (test + JaCoCo), coverage artifact
  - governance: Flyway migration + i18n parity guards
  - secrets: gitleaks; dependency-review on PRs; docker compose build
  - ci-required: single aggregate status check for branch protection
- scripts/ci: flyway-governance.sh, i18n-parity.sh (shared with GitLab later)
- frontend: add typecheck script (tsc --noEmit)
- third-party actions pinned by commit SHA
- remove build-services.yml (superseded)

- CodeQL SAST for Java and JavaScript/TypeScript
- Trivy filesystem and config scans, results to GitHub code scanning
- OpenSSF Scorecard with published results
- CycloneDX SBOM with build-provenance attestation
- third-party actions pinned by commit SHA

- deploy.yml: SSH-based CD running update.sh on the server; prod (main)
  and staging (dev) targets, each gated by a repo variable so forks skip it
- dependabot.yml: per-directory updates (maven, npm, docker, actions);
  groups minor/patch; ignores the Next.js fork
- .gitlab-ci.yml: mirror reusing scripts/ci and native GitLab security templates
- README: CI, Security, Scorecard and license badges

- backend job: add ephemeral Postgres service so @SpringBootTest can load
- secrets job: run gitleaks binary directly (no org license required)
- fix unescaped quotes in ai-generator-form
- add missing French bookmarks translations (i18n parity)

- notify job aggregates frontend, backend, governance, secrets, docker
- no-ops when DISCORD_WEBHOOK_URL is unset (fork-safe); action pinned by SHA

Add docker-compose.monitoring.yml with Prometheus, Grafana, Loki,
Promtail, node-exporter and cAdvisor, all bound to the internal
network with no public port. Grafana is reachable via SSH tunnel only.

Prometheus scrapes the backend, host, containers and Caddy; retention
is 15d for metrics and 7d for logs. Grafana ships provisioned
datasources and dashboards (JVM/Spring, VPS system, containers, logs).

Expose Caddy's admin metrics endpoint on the internal network and add
a `make monitoring` target plus README instructions.