feat: auto-deploy to production after images are built

[cfsmp3]

Summary

Makes deployment fully automatic by adding a deploy job to the Docker build workflow.

Before: Push to main → images built → manual trigger required to deploy
After: Push to main → images built → auto-deploy to production

How It Works

push to main
    ↓
┌─────────────────────────────────────┐
│  build-and-push-frontend (parallel) │
│  build-and-push-backend  (parallel) │
└─────────────────────────────────────┘
    ↓ (both must succeed)
┌─────────────────────────────────────┐
│  deploy                             │
│  - SSH to VPS                       │
│  - Run deploy.sh with commit SHA    │
│  - Health check + auto-rollback     │
└─────────────────────────────────────┘

Safety

• Deploy only runs if both build jobs succeed
• Uses commit SHA as image tag (immutable)
• deploy.sh has automatic rollback on health check failure
• GitHub environment protection can add required reviewers if needed

Test plan

• Merge this PR
• Verify the deploy job runs automatically
• Check https://taskwarrior-server.ccextractor.org is updated

🤖 Generated with Claude Code

[github-actions]

Thank you for opening this PR!

Before a maintainer takes a look, it would be really helpful if you could walk through your changes using GitHub's review tools.

Please take a moment to:

• Check the "Files changed" tab
• Leave comments on any lines for functions, comments, etc. that are important, non-obvious, or may need attention
• Clarify decisions you made or areas you might be unsure about and/or any future updates being considered.
• Finally, submit all the comments!

More information on how to conduct a self review:
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request

This helps make the review process smoother and gives us a clearer understanding of your thought process.

Once you've added your self-review, we'll continue from our side. Thank you!