Simplify deployment into an easily installable cloud-agnostic bundle

[javiertoledo]

Problem

The self-host path today is a multi-hour, AWS-specific Terraform runbook (ECS, RDS, CloudFront, Secrets Manager, one-shot bootstrap tasks). That is a hard blocker for adoption: someone evaluating the platform should reach a working governed run in minutes, not in an afternoon of infrastructure work.

Scope

• Define the minimal deployable unit (api + worker + gateway + web + Postgres) and ship it as a cloud-agnostic bundle: one docker compose up (or equivalent) driven by a single configuration file.
• Automate what is manual today: migrations, master key, operator bootstrap, and GitHub App creation (the App manifest flow can register the App, its permissions and its webhook programmatically — see feat: Digital Product Owner v1 — typed knowledge base, pipeline tools, HITL backlog flows #34).
• Keep the Terraform path as the "production reference" profile; the bundle is the adoption path.
• Keep tenancy assumptions out of the bundle so it can also serve as a substrate for hosted deployments.

Acceptance

• Someone with Docker and a GitHub organization gets a working governed run on a test repository in under 15 minutes, following one documentation page.
• No step requires reading Terraform.

[Lob26]

Two of the acceptance criteria here have moved.

#333 fixes why docker compose up does not start the API today. The api image runs in production mode, the compose file defaults the preview origin to plain HTTP, and production validation refuses that. It also adds the single documentation page this issue asks for.

#336 makes the operator bootstrap runnable from the bundle, so binding the first owner no longer needs a local Node toolchain or ten flags typed correctly.

What is still open is creating the GitHub App by hand. Nothing in the code uses the App manifest flow yet, and that is the step that costs the most minutes. Happy to take it if nobody else is on it.