ops: station-bot CI/CD parity — GitHub Actions deploy pipeline with scoped secrets

[GitAddRemote]

Tech Story

As a platform engineer, I want station-bot deployments to use the same automated CI/CD pipeline and secrets management pattern as Station, so that both services have a consistent, auditable, and secure deployment process.

Current state

Station-bot is deployed manually:

1. SSH as deploy user
2. `cd /opt/station-bot && docker compose -f docker-compose.prod.yml pull`
3. Stop and restart services
4. Run migrations if needed
5. Check logs

Target state

Mirror the Station CI/CD pattern:

• Release-tag triggered GitHub Actions workflow in the station-bot repo
• SSH deploy step runs a `deploy-station-bot.sh` script on the VPS
• Secrets stored in GitHub environment-scoped secrets (not repo-level)
• Pre-deploy postgres backup before any migration run
• Post-deploy health check and log tail
• Deploy script committed to station-bot repo under `infra/scripts/`

Dependencies

• Depends on: chore: harden VPS deploy user — rootless Docker or narrowed sudoers #129 (rootless Docker must be in place — deploy user hardening)
• Depends on: station-bot repo having a working GHCR image publish workflow (already exists)