fix(deploy): rework prod artifacts to match the actual Hetzner box

Server recon (read-only SSH) showed the box already runs ~8 apps behind a
host-level nginx, with Gitea + an Actions runner. The host-networking
design collided with contentra on port 3001.

- docker-compose.prod.yml: bridge networking + per-app network, house
  style; api/web/postgres/redis publish to 127.0.0.1 on verified-free
  ports (4000/4001/5440/6390); only the generator keeps host networking
  (no listening port, needs the host namespace for runner-port probing).
- Drop the Traefik config; the box uses a host nginx. Add a ready nginx
  vhost in infra/nginx/buildmymcpserver.conf (listen 80, Cloudflare TLS).
- Add .gitea/workflows/deploy.yml mirroring the buildmydiscord pipeline.
- Narrow the generated-MCP port range to 4400-4900 (clear of screencraft
  on 4321).
- .env.production.example + DEPLOY.md rewritten for buildmymcpserver.com
  and the real topology.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -0,0 +1,36 @@
+name: Deploy to Production
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: bmm-deploy
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: hetzner
+    steps:
+      - name: Pull from Gitea + rebuild containers
+        run: |
+          set -eo pipefail
+          : "${HOME:=/root}"
+          export HOME
+          cd /opt/buildmymcpserver
+          git fetch gitea main
+          git reset --hard gitea/main
+          docker compose --env-file .env.production -f docker-compose.prod.yml up -d --build
+          docker system prune -f
+
+      - name: Health check
+        run: |
+          set -e
+          for i in $(seq 1 30); do
+            code=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:4000/health 2>/dev/null || echo 000)
+            if [ "$code" = "200" ]; then echo "API healthy after $i attempts"; exit 0; fi
+            echo "wait $i/30 (got $code)"
+            sleep 5
+          done
+          docker logs bmm-api --tail 60 || true
+          exit 1