infra: establish one reproducible enterprise deployment and operations baseline

What is missing

Render configuration, Terraform, Docker and Compose describe different systems. Terraform omits staging and the worker, contains placeholder remote-state configuration, and has no committed provider lock. The deployed RAG vector store is neither built nor mounted. There are no project SLOs, alert ownership, RTO/RPO, restore drill, capacity evidence or tested coordinated rollback.

Runtime dependencies are also resolved from broad/unhashed requirements, while release images are published independently of the strongest signed source-release gate.

Required work

Choose one authoritative deployment topology and make it reproducible, observable and recoverable.

Acceptance criteria

• Live resources are imported into one approved IaC source of truth with locked state/providers and drift checks.
• Production and isolated staging include API, worker, database, backups, alerts and required data artifacts.
• RAG is a versioned verified artifact/managed store or its unavailable features are disabled.
• Runtime/dev dependencies are separated and locked with hashes; vulnerability exceptions have owner, issue and expiry.
• Container digest is tied to a verified main-ancestor release tag, scanned, SBOMed, attested and signed.
• SLOs, alert routes, on-call ownership, capacity limits, retention, RTO and RPO are approved.
• Backup restore, expand/contract migration and coordinated rollback drills are executed and recorded.
• API and worker metrics are observable from the deployed topology.

Related: #199 and #243.