ci: add automated frontend deployment

[alekskjo]

Summary

• add a self-hosted frontend quality gate for pull requests
• validate and deploy only pushes to main
• add root-owned deployment, rollback, systemd and sudoers templates
• publish through atomic release symlinks while retaining the previous release
• document the security boundaries and deployment model
• fix the favicon path for the /project2 base path

Security

• the Project 2 runner uses a separate non-login account
• the runner cannot write to the production directories or read the deploy key
• its only elevated command starts one fixed deployment service with no arguments
• the deploy service independently fetches and verifies origin/main
• Project 1 paths, users and services are not changed
• no credentials or environment values are committed

Local verification

• npm ci
• npm run format:check
• npm run lint
• npm run test — 8 tests passed
• npm run build
• shell syntax and Git diff checks

The VM installation and end-to-end deployment will be verified before merge.

Closes #46

[erikbsa]

Looks good to me. The deployment setup is clearly documented, the frontend quality checks pass, and the VM deployment has been tested. Approved.