deploy(prod): pre-deploy DB backup + paired code/DB rollback skill

Every `just deploy` now takes a pg_dumpall to
/opt/colectivo/backups/predeploy-<ts>-<sha>.sql.gz BEFORE rebuilding the
app or applying migrations, aborts the deploy if the dump is < 1 KiB,
and (on success) appends `<iso-ts> \t <sha> \t <backup-file>` to
/opt/colectivo/.deploys.log on ambrosio. Keeps the newest 10 backups
(prunes older predeploy-* files).

New `infra/scripts/rollback-erosi.sh` reads .deploys.log and pairs a
code rollback with a DB restore atomically:

  just rollback-list          # show recent deploys
  just rollback               # roll back to N-1
  just rollback-to <sha>      # roll back to a specific deploy
  just rollback-code          # roll back code only, keep current DB

Rollback safety:
- 5-second abort window.
- Verifies the target SHA exists locally + the backup is still on prod
  (warns if it's been pruned past the 10-deploy window).
- Uses a temporary git worktree so the user's working tree isn't
  disturbed.
- Stops app/auth/rest/realtime/storage before the gunzip|psql restore.
- Rebuilds the app image at the rolled-back SHA with the same GIT_SHA
  build-arg path the deploy uses (so __APP_COMMIT__ in the bundle
  matches the running code).
- Does NOT write a new .deploys.log entry — rollback is intentionally
  not a deploy event; the next `just deploy` is from current HEAD.
- Storage volume (/var/lib/storage user uploads) is NOT rolled back.

Justfile `deploy` recipe repointed from the stale `deploy.sh` (which
referenced GHCR pull) to `deploy-erosi.sh` (the active prod path).

New project-scoped skill: `.claude/skills/deploy/SKILL.md` documents the
flow + safety boundaries for Claude-assisted invocations. `.gitignore`
keeps `.claude/settings.local.json` ignored but tracks `.claude/skills/`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Justfile

@@ -203,9 +203,28 @@ restore service file:
 
 # ── Production ────────────────────────────────────────────────────────────────
 
-# Deploy to production via SSH
+# Deploy to production via SSH (ambrosio / erosi.limonia.net).
+# Pre-deploy: dumps the prod DB to /opt/colectivo/backups/predeploy-<ts>-<sha>.sql.gz
+# Post-deploy: appends (timestamp, sha, backup) to /opt/colectivo/.deploys.log
 deploy:
-    infra/scripts/deploy.sh
+    infra/scripts/deploy-erosi.sh
+
+# List recent prod deploys (timestamp / sha / backup-file).
+rollback-list:
+    infra/scripts/rollback-erosi.sh --list
+
+# Roll back code AND database to the previous deploy.
+# For a specific deploy: `just rollback-to <sha>`.
+rollback:
+    infra/scripts/rollback-erosi.sh --previous
+
+# Roll back to a specific deploy by sha (must exist in .deploys.log on prod).
+rollback-to sha:
+    infra/scripts/rollback-erosi.sh --to={{sha}}
+
+# Roll back only code (skip DB restore). Useful if the regression is UI-only.
+rollback-code:
+    infra/scripts/rollback-erosi.sh --previous --code-only
 
 # Stream production Docker logs
 logs: