chore: NTDF-RTMP Production Deployment Checklist

## Summary
Production deployment checklist for NTDF-RTMP encrypted streaming on arkavo-rs.

## Server Requirements

### arkavo-rs Configuration
- [ ] RTMP_PORT=1935 configured in production/start.sh
- [ ] KAS EC private key deployed (`recipient_private_key.pem`)
- [ ] Redis server running for manifest caching
- [ ] NATS server running for pub/sub messaging
- [ ] TLS certificates configured for HTTPS KAS endpoint

### Network/Firewall
- [ ] Port 1935 (RTMP) open for inbound connections
- [ ] Port 443 (HTTPS) open for KAS public key endpoint
- [ ] Consider RTMPS (TLS-encrypted RTMP) for additional transport security

### Monitoring
- [ ] RTMP connection logging enabled
- [ ] Stream start/stop events logged
- [ ] Error tracking for encryption failures
- [ ] Redis manifest cache monitoring

## Client Requirements (ArkavoKit)

### Publisher
- [ ] KASPublicKeyService configured with production KAS URL
- [ ] NTDFStreamingManager handles network errors gracefully
- [ ] Reconnection logic for dropped connections
- [ ] Stream key validation

### Integration
- [ ] Camera capture → H.264 encoding → NTDF encryption pipeline
- [ ] Audio capture → AAC encoding → NTDF encryption pipeline
- [ ] Sequence headers (SPS/PPS, AudioSpecificConfig) sent unencrypted

## Testing Checklist

### Functional
- [x] KAS public key fetch from production server
- [x] NanoTDF Collection creation
- [x] RTMP handshake and connect
- [x] Metadata with ntdf_header transmission
- [x] Encrypted frame transmission
- [ ] Real H.264/AAC content streaming
- [ ] Multi-viewer scenario

### Performance
- [ ] Encryption latency < 1ms per frame
- [ ] Total encode-to-wire latency < 100ms
- [ ] Stable bitrate over extended streaming

### Error Handling
- [ ] Network disconnect recovery
- [ ] KAS server unavailable handling
- [ ] Invalid stream key rejection

## Deployment Steps
1. Build arkavo-rs with `./build-release.sh`
2. Deploy binary to production server
3. Configure environment variables in `production/start.sh`
4. Start with `sudo -E ./production/start.sh`
5. Verify RTMP listening: `netstat -an | grep 1935`
6. Test with `ntdf-test` CLI

## Rollback Plan
- Keep previous arkavo-rs binary available
- Redis manifest data is ephemeral (no migration needed)
- Monitor logs for first 24 hours post-deployment

Review production/start.sh and build-release.sh first, then use the deployment steps to inspect the arkavo-rs production setup and run the ntdf-test CLI. Confirm the server, client, functional, performance, error-handling, monitoring, and rollback checklist items, with real H.264/AAC streaming and multi-viewer testing completed before marking the checklist done.

Written by the indexing model from the issue text.