feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/architecture/deployment.md

@@ -1,3 +1,16 @@
 # deployment
 
-TODO: Complete documentation.
+Production runs the frontend/nginx, ASP.NET API, AI sidecar, and configured database through Docker
+Compose. The backend is not published directly; nginx proxies `/api`. `deploy/deploy.sh` validates
+configuration, takes and verifies a provider-appropriate backup before replacement, builds/restarts the
+stack, and performs health checks.
+
+Production compose enables `Proxy:TrustForwardedHeaders` because nginx is the sole ingress, allowing
+HTTPS scheme and client-IP rate limits to use one trusted forwarded hop. The development override
+publishes the API directly and disables forwarded-header trust.
+
+Each service rotates local Docker logs at 10 MB and retains three files. Add a central sink only if
+cross-host search or longer retention becomes necessary.
+
+Use `deploy/README.md`, `deploy/first-production-deployment.md`, and
+`docs/deployment/backup-restore.md` as the operational runbooks.