add: sa-wellness prod provision + versioned deploy playbooks (Gate 3)
Additions-only. provision-sa-wellness-prod.yml creates the sa-wellness-prod LXC with docker (Semaphore provisions prod). deploy-sa-wellness.yml promotes an immutable vX.Y.Z registry image: requires version arg (rollback = prior tag), runs PostgreSQL + one-time migrations, runs the non-root API, verifies /healthz + /readyz 200. Secrets (REGISTRY_*, SA_DB_PASSWORD, SA_JWT_SIGNING_KEY, SA_CORS_ORIGINS) injected by Semaphore from Infisical, never committed.
b000a132ac