feat(deploy): production deployment setup and fixes

- Debian-based api image (bookworm-slim), docker/debian mirrors, prisma
  binaryTargets for openssl 3.0
- nginx: admin SPA under /admin, TLS via acme.sh (ZeroSSL) + auto-renewal
  cron, http->https redirect
- prisma: add origin_goods.delisted migration, sync missing schema
  (good_image/tag_font_color/good_tags), fix users.createdAt Timestamptz
- api: CORS wildcard reflection, helmet CORP cross-origin, price
  backfill in persistProductDetail, categoryIcon ancestor fallback,
  mediaByColor per-color gallery in public goods detail
- admin: /admin base path (vite + router)
- import-data.mjs: udt_name casting, serial sequence advance fix

.agents/skills/supabase-postgres-best-practices/references/lock-advisory.md

@@ -1,56 +0,0 @@
----
-title: Use Advisory Locks for Application-Level Locking
-impact: MEDIUM
-impactDescription: Efficient coordination without row-level lock overhead
-tags: advisory-locks, coordination, application-locks
----
-
-## Use Advisory Locks for Application-Level Locking
-
-Advisory locks provide application-level coordination without requiring database rows to lock.
-
-**Incorrect (creating rows just for locking):**
-
-```sql
--- Creating dummy rows to lock on
-create table resource_locks (
-  resource_name text primary key
-);
-
-insert into resource_locks values ('report_generator');
-
--- Lock by selecting the row
-select * from resource_locks where resource_name = 'report_generator' for update;
-```
-
-**Correct (advisory locks):**
-
-```sql
--- Session-level advisory lock (released on disconnect or unlock)
-select pg_advisory_lock(hashtext('report_generator'));
--- ... do exclusive work ...
-select pg_advisory_unlock(hashtext('report_generator'));
-
--- Transaction-level lock (released on commit/rollback)
-begin;
-select pg_advisory_xact_lock(hashtext('daily_report'));
--- ... do work ...
-commit;  -- Lock automatically released
-```
-
-Try-lock for non-blocking operations:
-
-```sql
--- Returns immediately with true/false instead of waiting
-select pg_try_advisory_lock(hashtext('resource_name'));
-
--- Use in application
-if (acquired) {
-  -- Do work
-  select pg_advisory_unlock(hashtext('resource_name'));
-} else {
-  -- Skip or retry later
-}
-```
-
-Reference: [Advisory Locks](https://www.postgresql.org/docs/current/explicit-locking.html#ADVISORY-LOCKS)