fix(deploy): make LXC deploys atomic and fail-fast

Rebuild the deployment flow to prepare releases remotely, validate env/sudo prerequisites, run migrations in-release, and auto-rollback on health failures. Consolidate deployment docs and add a manual CI workflow so laptop and CI use the same push-based deploy path.

scripts/healthcheck.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+#
+# Health check script for innercontext services
+# Should be run via cron every 5 minutes:
+# */5 * * * * /opt/innercontext/scripts/healthcheck.sh >> /opt/innercontext/healthcheck.log 2>&1
+#
+
+set -euo pipefail
+
+BACKEND_URL="http://127.0.0.1:8000/health-check"
+FRONTEND_URL="http://127.0.0.1:3000/"
+TIMEOUT=10
+TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
+
+# Color codes
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+log() {
+    echo "[$TIMESTAMP] $1"
+}
+
+check_service() {
+    local service_name=$1
+    local url=$2
+    
+    if systemctl is-active --quiet "$service_name"; then
+        if curl -sf --max-time "$TIMEOUT" "$url" > /dev/null 2>&1; then
+            log "${GREEN}✓${NC} $service_name is healthy"
+            return 0
+        else
+            log "${YELLOW}⚠${NC} $service_name is running but not responding at $url"
+            return 1
+        fi
+    else
+        log "${RED}✗${NC} $service_name is not running"
+        return 1
+    fi
+}
+
+# Check all services
+backend_ok=0
+frontend_ok=0
+worker_ok=0
+
+check_service "innercontext" "$BACKEND_URL" || backend_ok=1
+check_service "innercontext-node" "$FRONTEND_URL" || frontend_ok=1
+
+# Worker doesn't have HTTP endpoint, just check if it's running
+if systemctl is-active --quiet "innercontext-pricing-worker"; then
+    log "${GREEN}✓${NC} innercontext-pricing-worker is running"
+else
+    log "${RED}✗${NC} innercontext-pricing-worker is not running"
+    worker_ok=1
+fi
+
+# If any service is unhealthy, exit with error code
+if [ $backend_ok -ne 0 ] || [ $frontend_ok -ne 0 ] || [ $worker_ok -ne 0 ]; then
+    log "${RED}Health check failed${NC}"
+    exit 1
+else
+    log "${GREEN}All services healthy${NC}"
+    exit 0
+fi