Add rollback-safe VPS deployment lane

[YesterdaysLemon]

Closes #9.

What changed

• packages the Vinext server as a non-root, health-checked production container
• adds GET/HEAD /healthz and an exact Origin-Trial runtime postflight
• smoke-tests the real container in CI
• adds an app-scoped, signed exact-SHA Deploy Manager notification job
• updates architecture, technical, product, and submission documentation for the VPS + Cloudflare lane

Local verification

• npm test — 28 passed
• npx tsc --noEmit — passed
• npm audit --omit=dev --audit-level=high — 0 vulnerabilities
• npm run build — passed; / dynamic and /healthz API route present
• docker build --pull --tag conspiracy:vps-preflight . — passed
• npm run check:production -- http://127.0.0.1:4197/ against the container — health, HEAD, exact Origin-Trial header, and meta tag passed