feat: implement deploy/ — production deploy & CI/CD (Front 4)

[guidevit-dealsmartai]

Context

Part of the Application Layer design (Issue #7). Front 4 of 4 — merges last.

Scope

Implement production deployment infrastructure under deploy/ and CI/CD pipelines under .github/workflows/. This front provides everything needed to run VigiaBR on a VPS with Docker and Caddy.

Deliverables

Docker (deploy/docker/)

File	Description
docker-compose.prod.yml	Full production stack: PG, Neo4j, Airflow, backend, frontend, Caddy, Grafana, Prometheus
Dockerfile.backend	Multi-stage build: uv install → uvicorn serve
Dockerfile.frontend	Multi-stage build: pnpm install → next build → standalone output
Dockerfile.scoring	Reuses backend base + scoring dependencies

Caddy (deploy/caddy/)

File	Description
Caddyfile	Reverse proxy: vigiabr.com.br → frontend:3000, api.vigiabr.com.br → backend:8000, auto-HTTPS

CI/CD (deploy/ci/ → .github/workflows/)

Workflow	Description
ci.yml	Lint (ruff + mypy + tsc + eslint), test (pytest + pnpm test), build
deploy.yml	Build Docker images → push to registry → SSH deploy to VPS

E2E Tests (deploy/e2e/)

File	Description
test_smoke.py	Health check: API 200, frontend 200
test_integration.py	Search → profile → verify SCI + inconsistency cards

Scripts (deploy/scripts/)

File	Description
deploy.sh	Production deploy script (pull, build, up, health check)
seed-demo.py	Generate realistic demo data for staging

Key Concerns

• Zero-downtime deploy (Docker Compose profiles)
• Caddy auto-HTTPS (Let's Encrypt)
• Resource limits in compose (VPS has ~8GB RAM)
• Health checks on all services
• Secrets via .env file (never committed)
• Docker build caching for fast CI

Dependencies

• Depends on: all other fronts (needs services to exist for compose + CI)
• Merges last

Branch

feat/11-production-deploy (from develop)