feat: prepare ARR for controlled public deployment

deploy/.env.production.example

@@ -0,0 +1,45 @@
+# Copy to deploy/.env.production, fill every required value, then chmod 600.
+# Never commit deploy/.env.production.
+
+ARR_IMAGE_NAME=wyndham-arr
+ARR_IMAGE_TAG=latest
+
+# Two DNS records pointing to this server. Use hostnames only, without scheme/path.
+WEB_PUBLIC_HOST=arr.example.com
+MCP_PUBLIC_HOST=mcp.example.com
+ACME_EMAIL=ops@example.com
+
+# Caddy bcrypt hash. Generate interactively with `caddy hash-password`.
+WEB_BASIC_AUTH_USER=arrtester
+WEB_BASIC_AUTH_PASSWORD_HASH=replace_with_caddy_bcrypt_hash
+
+# MCP transport authentication. Use an independent random 32-256 byte ASCII token.
+ARR_MCP_BEARER_TOKEN=replace_with_independent_random_token
+ARR_MCP_MAX_CONCURRENCY=2
+
+# Must target the isolated PostgreSQL 15+ database named booking_test.
+ARR_DATABASE_URL=postgresql://arr_app:replace_me@db.example.internal:5432/booking_test?sslmode=require
+
+# ARR -> SuperAgent Open API. This credential is not the MCP bearer.
+DEERFLOW_BASE_URL=https://superagent.example.com
+DEERFLOW_OPEN_API_KEY=replace_with_superagent_open_api_key
+DEERFLOW_AUTH_MODE=bearer
+DEERFLOW_TIMEOUT_SECONDS=60
+DEERFLOW_CONNECT_TIMEOUT_SECONDS=10
+
+# Independent callback/signature material required by the processing runtime.
+ARR_AGENT_RESULT_HMAC_KEY_ID=arr-callback-key-1
+ARR_AGENT_RESULT_HMAC_KEY_B64=replace_with_base64_of_32_random_bytes
+ARR_AGENT_RESULT_MAX_AGE_SECONDS=600
+
+# Private, encrypted, unversioned OSS bucket. public-read-write is rejected.
+ARR_OBJECT_PREFIX=arr
+ARR_OSS_REGION=cn-hangzhou
+ARR_OSS_ENDPOINT=https://oss-cn-hangzhou.aliyuncs.com
+ARR_OSS_BUCKET=replace-with-private-bucket
+
+# Prefer a RAM role or short-lived STS credentials in production. The stock
+# Compose profile accepts environment credentials for an initial controlled test.
+OSS_ACCESS_KEY_ID=replace_me
+OSS_ACCESS_KEY_SECRET=replace_me
+# OSS_SESSION_TOKEN=replace_me