Add systemd units + Caddyfile for bare-metal self-host

[tayebmokni]

Summary

Ship systemd service units and a Caddyfile for the bare-metal self-host path. Goal: a self-hoster moving from cPanel/Plesk should be able to install on a 2-vCPU/4-GB VPS in under 15 minutes, with auto-TLS via Caddy.

Design reference

• docs/09-deployment-ops.md §6 (Bare-metal self-host)

Acceptance criteria

• deploy/systemd/donext-core-api.service, donext-core-worker.service, donext-core-cron.service, donext-public-web.service, donext-admin-web.service
• All units use Type=notify (Go) / Type=simple (Node), User=donext, Group=donext, EnvironmentFile=/opt/donext/config/donext.env
• Hardening: NoNewPrivileges, PrivateTmp, ProtectSystem=strict, ProtectHome, ReadWritePaths=/opt/donext/data /opt/donext/log, restricted address families, LockPersonality
• Caddyfile template with auto-TLS, gzip/zstd encoding, reverse proxies for /api/* + /graphql to :8080 and root to :3000; admin host routes :3001
• Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy headers set
• Installer shell script in deploy/baremetal/install.sh covering the §6.2 nine steps (user creation, secrets, OS-pkg PG/Redis, migrate, unit install, caddy reload, ufw, LE cert)
• Tested install on a fresh Ubuntu 22.04 VM in CI (or manual repro doc)

Dependencies

none

Complexity

L