Release — hardening & deploy
- fix: harden social-auth issuer/audience checks and JWKS rotation handling
- docs: add deployment guide, social-auth setup and public README with screenshots
- chore: finalize Caddy TLS reverse proxy and production docker-compose for v1.0 release