ci: add secret/vuln scanning + staging & production deploy pipelines

security.yml: gitleaks secret scan + NuGet/npm vulnerability gate on PRs and
pushes to main/develop (detective backstop to the pre-commit hook).
deploy-staging.yml: on merge to develop, re-verify then rebuild the isolated
local staging stack (needs a self-hosted Windows runner).
deploy-prod.yml: tag-gated production promotion (the tag is the approval), ready
to activate once the Linux server + its runner exist.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,9 @@ All notable changes to InboxIntel are documented here. Format follows
 
 ## [Unreleased]
 ### Added
+- CI/CD pipeline (`.gitea/workflows/`): `security` (gitleaks secret scan + NuGet/npm
+  vulnerability gate), `deploy-staging` (auto-redeploy local staging on `develop`),
+  `deploy-prod` (tag-gated production promotion, inactive until the server exists).
 - Formal Git workflow & environment strategy (`docs/WORKFLOW.md`).
 - Staging environment overlay (`docker-compose.staging.yml`) — production-shaped
   Linux containers on Windows, isolated ports/volumes.