devops: add staging deploy runbook and release policy (refs #20 #23)

docs/RELEASE_POLICY.md

@@ -0,0 +1,4 @@
+Release policy issue 23
+- Tag only after successful deploy
+- Changelog reference required
+- No deploy while tester active

infra/staging/README.md

@@ -0,0 +1,4 @@
+Staging runbook issue 20
+CT 143 wpp-staging
+Service: wpp-staging.service
+Health: /healthz

infra/staging/deploy_staging.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+CT_ID="143"
+ARCHIVE_URL="https://gitea.weircon.dk/wpp/weirsoe-party-protocol/archive/main.tar.gz"
+sudo -n pct exec "" -- bash -lc "set -euo pipefail; mkdir -p /opt/wpp-staging/releases/src; cd /opt/wpp-staging/releases; curl -fsSL -o main.tar.gz ; rm -rf src && mkdir src; tar -xzf main.tar.gz -C src --strip-components=1; rm -rf /opt/wpp-staging/app/*; cp -a src/. /opt/wpp-staging/app/; cd /opt/wpp-staging/app; runuser -u wpp -- python3 -m venv .venv; runuser -u wpp -- .venv/bin/pip install -U pip >/dev/null; runuser -u wpp -- .venv/bin/pip install -r requirements.txt >/dev/null; runuser -u wpp -- .venv/bin/python manage.py migrate --noinput; systemctl restart wpp-staging.service; curl -fsS http://127.0.0.1:8000/healthz"
+echo "OK: staging deploy complete for CT ."