Add CI/CD pipeline: Woodpecker, auto-staging / manual-prod

Adds .woodpecker.yml (lint + typecheck on every push, auto-deploy to a
shared staging environment on every push, manual Deploy-button promotion to
production on main) and env.staging blocks in both wrangler configs so
staging gets its own Workers (diagrav-app-staging/diagrav-site-staging at
staging-app.diagrav.com/staging.diagrav.com) rather than sharing anything
with production.

Staging also got its own fully separate Supabase Cloud project (own
database, own Auth config reusing the same Google OAuth client with an
extra redirect URI, own Resend-backed SMTP) — migrated, seeded with the
public catalog, and verified end-to-end with a real sign-in through the
deployed app before wiring any of this into CI.

Updates deployment-plan.md's CI/CD section to match what actually got
built, superseding the earlier manual-pushbutton-for-both-environments
version of the plan.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017DUU6CnxECCDeqDNYJgr5x

wrangler.app.jsonc

@@ -1,7 +1,9 @@
 // Deploys the built Vite app (dist/) as an assets-only Cloudflare Worker.
 // No server-side code — this is purely static hosting for app.diagrav.com.
-// Build first (with production VITE_* env vars baked in), then:
-//   npx wrangler deploy --config wrangler.app.jsonc
+// Build first (with the right VITE_* env vars baked in for the target
+// environment — see the CI/CD section of deployment-plan.md), then:
+//   npx wrangler deploy --config wrangler.app.jsonc            (production)
+//   npx wrangler deploy --config wrangler.app.jsonc --env staging
 {
   "$schema": "./node_modules/wrangler/config-schema.json",
   "name": "diagrav-app",
@@ -15,5 +17,21 @@
       "pattern": "app.diagrav.com",
       "custom_domain": true
     }
-  ]
+  ],
+  // Own Worker, own route, own build (with staging's VITE_SUPABASE_* baked
+  // in) — never shares runtime state with production. `assets.directory`
+  // isn't overridable per-environment in Wrangler, which is fine here: it's
+  // the same dist/ folder either way, just rebuilt with different env vars
+  // immediately before each deploy.
+  "env": {
+    "staging": {
+      "name": "diagrav-app-staging",
+      "routes": [
+        {
+          "pattern": "staging-app.diagrav.com",
+          "custom_domain": true
+        }
+      ]
+    }
+  }
 }