ci: add demo deployment pipeline with tag-triggered CI/CD

[mighty840]

Summary

• Add GitHub Actions workflow triggered on v* tags that builds Docker images (server, admin, storefront), pushes to GHCR, and deploys to demo.kitchenasty.com via SSH
• Add Caddy reverse proxy config with auto-HTTPS — routes /admin/* to admin container, everything else to storefront
• Add production docker-compose with postgres, server, admin, storefront, and caddy services
• Support configurable VITE_BASE_PATH in admin Dockerfile and vite config so admin can be served under /admin/
• Add basename to BrowserRouter so React Router respects the Vite base path

Architecture

Internet → Caddy (443/80) → storefront:80  (/)
                           → admin:80      (/admin/*)

admin nginx  ─┐
storefront nginx ─┤─→ server:3000 (internal)
                           │
                     postgres:5432 (internal)

Required GitHub Secrets

Secret	Description
SSH_PRIVATE_KEY	Private SSH key for server access
SSH_USER	SSH username (e.g., deploy)
DEMO_JWT_SECRET	JWT secret for the demo instance

Test plan

• Verify admin still works locally on / (default VITE_BASE_PATH)
• Set GitHub secrets on the repo
• Push a v* tag to trigger the workflow
• Verify all 3 images build and push to GHCR
• Verify SSH deploy succeeds
• Visit https://demo.kitchenasty.com — storefront loads
• Visit https://demo.kitchenasty.com/admin — admin login loads
• Login and verify API calls work

🤖 Generated with Claude Code