build(elections): deploy elections.us-rse.org (DNS, hosting, CI/CD)

Summary

Stand up the production deployment for the elections app at `elections.us-rse.org`, wired to the same CI/CD pipeline as the marketing site.

Part of #1933.

Requirements

• Choose and configure hosting target (Netlify / Vercel / Cloudflare Pages / S3+CloudFront) — align with current marketing site host
• Register the `elections.us-rse.org` subdomain and point DNS at the host
• Configure TLS, HSTS, and security headers (CSP scoped to Convex endpoints)
• Create CI pipeline that builds and deploys `apps/elections` on merge to `main`
• Configure preview deployments for PRs touching `apps/elections/` or `packages/design-system/`
• Provision Convex prod deployment; store deploy keys in CI secrets
• Add a smoke test that hits the deployed URL and checks the ping query
• Document the deploy + rollback runbook in `docs/elections/deploy.md`

Context

• Epic: #1933
• Depends on the elections app scaffold issue

Implementation notes

• Keep marketing site and elections app as two separate deploys sharing the monorepo — simpler than subpath routing
• CSP should allow the Convex websocket + HTTPS origin only

Start by reviewing the marketing site's current hosting and CI/CD setup, then inspect the elections scaffold referenced by #1933 and the apps/elections path. The work is complete when the production URL, DNS, TLS and security headers, Convex deployment, merge and preview pipelines, smoke test, and docs/elections/deploy.md rollback runbook all meet the listed requirements.