feat(deploy): production deployment setup and fixes

- Debian-based api image (bookworm-slim), docker/debian mirrors, prisma
  binaryTargets for openssl 3.0
- nginx: admin SPA under /admin, TLS via acme.sh (ZeroSSL) + auto-renewal
  cron, http->https redirect
- prisma: add origin_goods.delisted migration, sync missing schema
  (good_image/tag_font_color/good_tags), fix users.createdAt Timestamptz
- api: CORS wildcard reflection, helmet CORP cross-origin, price
  backfill in persistProductDetail, categoryIcon ancestor fallback,
  mediaByColor per-color gallery in public goods detail
- admin: /admin base path (vite + router)
- import-data.mjs: udt_name casting, serial sequence advance fix

.agents/skills/nestjs-best-practices/.github/workflows/branch-protection.yml

@@ -1,24 +0,0 @@
-name: Branch Protection
-
-on:
-  pull_request:
-    branches: [main]
-
-jobs:
-  check-branch:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Block docs branch merge to main
-        if: github.head_ref == 'docs'
-        run: |
-          echo "::error::Merging 'docs' branch into 'main' is not allowed."
-          echo ""
-          echo "The 'docs' branch contains the documentation website which should"
-          echo "remain separate from the main skill files to keep installations lightweight."
-          echo ""
-          echo "If you need to sync changes, cherry-pick specific commits instead."
-          exit 1
-
-      - name: Branch check passed
-        if: github.head_ref != 'docs'
-        run: echo "Branch check passed - not merging from docs branch"

.agents/skills/nestjs-best-practices/.github/workflows/deploy.yml

@@ -1,61 +0,0 @@
-name: Deploy to GitHub Pages
-
-on:
-  push:
-    branches: [docs]
-    paths:
-      - 'website/**'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: pages
-  cancel-in-progress: false
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-          cache-dependency-path: website/package-lock.json
-
-      - name: Setup Pages
-        uses: actions/configure-pages@v4
-
-      - name: Install dependencies
-        run: npm ci
-        working-directory: website
-
-      - name: Build
-        run: npm run build
-        working-directory: website
-
-      - name: Copy index.html to 404.html for SPA routing
-        run: cp website/dist/index.html website/dist/404.html
-
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
-        with:
-          path: website/dist
-
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v4