Simplify deployment into an easily installable cloud-agnostic bundle

Problem

The self-host path today is a multi-hour, AWS-specific Terraform runbook (ECS, RDS, CloudFront, Secrets Manager, one-shot bootstrap tasks). That is a hard blocker for adoption: someone evaluating the platform should reach a working governed run in minutes, not in an afternoon of infrastructure work.

Scope

• Define the minimal deployable unit (api + worker + gateway + web + Postgres) and ship it as a cloud-agnostic bundle: one docker compose up (or equivalent) driven by a single configuration file.
• Automate what is manual today: migrations, master key, operator bootstrap, and GitHub App creation (the App manifest flow can register the App, its permissions and its webhook programmatically — see #34).
• Keep the Terraform path as the "production reference" profile; the bundle is the adoption path.
• Keep tenancy assumptions out of the bundle so it can also serve as a substrate for hosted deployments.

Acceptance

• Someone with Docker and a GitHub organization gets a working governed run on a test repository in under 15 minutes, following one documentation page.
• No step requires reading Terraform.

Start by reading the existing Terraform production-reference path and the deployment assumptions for the api, worker, gateway, web, and Postgres components. Review the GitHub App manifest flow described in #34, then define the bundle and its single configuration entry point. Done means a documentation page enables a Docker-equipped user with a GitHub organization to reach a governed test-repository run in under 15 minutes without reading Terraform.