feat(deploy): production deployment setup and fixes

- Debian-based api image (bookworm-slim), docker/debian mirrors, prisma
  binaryTargets for openssl 3.0
- nginx: admin SPA under /admin, TLS via acme.sh (ZeroSSL) + auto-renewal
  cron, http->https redirect
- prisma: add origin_goods.delisted migration, sync missing schema
  (good_image/tag_font_color/good_tags), fix users.createdAt Timestamptz
- api: CORS wildcard reflection, helmet CORP cross-origin, price
  backfill in persistProductDetail, categoryIcon ancestor fallback,
  mediaByColor per-color gallery in public goods detail
- admin: /admin base path (vite + router)
- import-data.mjs: udt_name casting, serial sequence advance fix

.agents/skills/impeccable/scripts/live-completion.mjs

@@ -1,19 +0,0 @@
-export function completionTypeForAcceptResult(eventType, acceptResult) {
-  if (eventType === 'discard') return acceptResult?.handled === true ? 'discarded' : 'error';
-  if (acceptResult?.handled === true && acceptResult?.carbonize === true) return 'agent_done';
-  if (acceptResult?.handled === true) return 'complete';
-  if (acceptResult?.mode === 'error') return 'error';
-  if (eventType === 'accept' && acceptResult?.previewMode === 'svelte-component') return 'error';
-  return 'agent_done';
-}
-
-export function completionAckForAcceptResult(eventId, completionType, acceptResult) {
-  const ack = { ok: true, type: completionType };
-  if (acceptResult?.handled === true && acceptResult?.carbonize === true) {
-    ack.final = false;
-    ack.requiresComplete = true;
-    ack.nextCommand = `live-complete.mjs --id ${eventId}`;
-    ack.message = 'Carbonize cleanup must be verified, then the session must be completed explicitly before polling again.';
-  }
-  return ack;
-}