ops: add persistent GraphQL backend service

[alekskjo]

What changed?

• add a dedicated t07p2api service account for the GraphQL runtime
• build verified backend releases from origin/main with typecheck, tests and build
• keep commit-specific current and previous backend releases
• run the API persistently on 127.0.0.1:3001 using systemd
• proxy only /project2/api/graphql through Apache
• keep the database credential in a root-owned environment file outside Git
• keep the CI runner separate from API credentials and runtime permissions

Verification

• backend typecheck passed
• all 57 backend tests passed
• backend build passed
• Prettier passed
• Oxlint passed
• all 27 frontend tests passed
• frontend production build passed
• deployment scripts pass bash -n
• systemd unit syntax was checked on the T07 Ubuntu VM

Deployment boundary

The committed files document the reviewed configuration. The API is not started directly from the repository checkout. After review, an administrator installs root-owned copies, provides /etc/t07-project2-api/backend.env privately, prepares the main release and verifies both the local and Apache-proxied GraphQL endpoints.

Part of #8

[ktnielse]

Looks good. This makes the backend run on the VM so the site works without any local setup.