feat(deploy): production deployment setup and fixes

- Debian-based api image (bookworm-slim), docker/debian mirrors, prisma
  binaryTargets for openssl 3.0
- nginx: admin SPA under /admin, TLS via acme.sh (ZeroSSL) + auto-renewal
  cron, http->https redirect
- prisma: add origin_goods.delisted migration, sync missing schema
  (good_image/tag_font_color/good_tags), fix users.createdAt Timestamptz
- api: CORS wildcard reflection, helmet CORP cross-origin, price
  backfill in persistProductDetail, categoryIcon ancestor fallback,
  mediaByColor per-color gallery in public goods detail
- admin: /admin base path (vite + router)
- import-data.mjs: udt_name casting, serial sequence advance fix

.agents/skills/nestjs-best-practices/.github/workflows/branch-protection.yml

@@ -1,24 +0,0 @@
-name: Branch Protection
-
-on:
-  pull_request:
-    branches: [main]
-
-jobs:
-  check-branch:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Block docs branch merge to main
-        if: github.head_ref == 'docs'
-        run: |
-          echo "::error::Merging 'docs' branch into 'main' is not allowed."
-          echo ""
-          echo "The 'docs' branch contains the documentation website which should"
-          echo "remain separate from the main skill files to keep installations lightweight."
-          echo ""
-          echo "If you need to sync changes, cherry-pick specific commits instead."
-          exit 1
-
-      - name: Branch check passed
-        if: github.head_ref != 'docs'
-        run: echo "Branch check passed - not merging from docs branch"