ci: GitHub Actions auto-deploy to production droplet on push to main

Workflow SSHes into the production droplet as `deploy` and runs
`/opt/hackerspace-ops/deploy.sh` which:
  - git fetches and resets to origin/main
  - rebuilds the app image with NEXT_PUBLIC_* baked in from .env.local
  - applies any new scripts/0NN_*.sql migrations not in the
    public._migrations_applied tracking table
  - hot-swaps the app container with `docker compose up -d --no-deps app`
  - prunes dangling images

Repo secrets DROPLET_HOST and DEPLOY_SSH_PRIVATE_KEY are configured.

Concurrency group `deploy-prod` with cancel-in-progress=false so two
pushes in quick succession queue rather than racing.

Also gitignores `secrets/` and `*.pem` so production credentials never
get committed.

.gitignore

@@ -26,3 +26,7 @@ playwright-report/
 # Supabase CLI local state
 supabase/.branches/
 supabase/.temp/
+
+# Production deployment secrets (never commit)
+secrets/
+*.pem