Add CI/CD pipeline: Woodpecker, auto-staging / manual-prod

Adds .woodpecker.yml (lint + typecheck on every push, auto-deploy to a
shared staging environment on every push, manual Deploy-button promotion to
production on main) and env.staging blocks in both wrangler configs so
staging gets its own Workers (diagrav-app-staging/diagrav-site-staging at
staging-app.diagrav.com/staging.diagrav.com) rather than sharing anything
with production.

Staging also got its own fully separate Supabase Cloud project (own
database, own Auth config reusing the same Google OAuth client with an
extra redirect URI, own Resend-backed SMTP) — migrated, seeded with the
public catalog, and verified end-to-end with a real sign-in through the
deployed app before wiring any of this into CI.

Updates deployment-plan.md's CI/CD section to match what actually got
built, superseding the earlier manual-pushbutton-for-both-environments
version of the plan.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017DUU6CnxECCDeqDNYJgr5x

wrangler.site.jsonc

@@ -1,7 +1,8 @@
 // Deploys the hand-written marketing site (site/) as an assets-only
 // Cloudflare Worker for the bare diagrav.com domain. No build step —
 // serves the folder as-is:
-//   npx wrangler deploy --config wrangler.site.jsonc
+//   npx wrangler deploy --config wrangler.site.jsonc            (production)
+//   npx wrangler deploy --config wrangler.site.jsonc --env staging
 {
   "$schema": "./node_modules/wrangler/config-schema.json",
   "name": "diagrav-site",
@@ -15,5 +16,18 @@
       "pattern": "diagrav.com",
       "custom_domain": true
     }
-  ]
+  ],
+  // Own Worker, own route — the marketing site has no build step/env vars,
+  // so this is just a separate deploy target, not a separate build.
+  "env": {
+    "staging": {
+      "name": "diagrav-site-staging",
+      "routes": [
+        {
+          "pattern": "staging.diagrav.com",
+          "custom_domain": true
+        }
+      ]
+    }
+  }
 }