Infra: split dev and production (releases, services, deploy script)

- Production now runs from ~/freezmo-prod/current (release symlink) as a
  standalone server on :3207; releases are exported by scripts/deploy.sh,
  built and e2e-verified on a temp port, switched atomically, health-
  checked via the new /api/healthz (commit + build time) and rolled back
  automatically on failure. Last 5 releases kept; scripts/rollback.sh for
  manual rollback. Shared env + data live in ~/freezmo-prod/shared/ and
  are symlinked into every release (existing sync/push data migrated and
  verified identical).
- Dev runs from ~/freezmo via freezmo-dev.service: next dev on :3217
  (LAN only), its own build folder (.next-dev via NEXT_DIST_DIR), its own
  data (~/freezmo/.freezmo-dev), DEV badge, dev favicon/theme colour,
  "Freezmo Dev" PWA identity and never the production service worker.
- /api/healthz + the Settings Details version row (short commit + build
  time). output: standalone in next.config (next start still works).
- AGENTS.md documents the workflow rules: only dev updates during a task,
  temporary dirs/ports for test builds, and deploy-at-the-end as the only
  production path. README gains an Environments and deploy section.
- Fix found by the rehearsal: lib/dev-mode.ts must not be a client module
  (a server component importing a constant from a "use client" module
  gets a truthy proxy, which baked dev metadata into production builds).
- SW -> freezmo-v34.

app/api/healthz/route.ts

@@ -0,0 +1,37 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+/**
+ * Deploy health check: reports which release is running. The deploy script
+ * writes `release.json` next to the server (in the standalone root) and polls
+ * this route after switching `current`; a mismatch or an unreachable server
+ * triggers the automatic rollback.
+ *
+ * In a dev checkout there is no release.json — the route answers with the
+ * commit baked into the environment, or "dev".
+ */
+export async function GET() {
+  let release: { commit?: string; short?: string; builtAt?: string; release?: string } | null = null;
+  try {
+    release = JSON.parse(readFileSync(path.join(process.cwd(), "release.json"), "utf8"));
+  } catch {
+    release = null;
+  }
+
+  const commit = release?.commit ?? process.env.FREEZMO_COMMIT ?? "dev";
+  return Response.json(
+    {
+      ok: true,
+      commit,
+      short: release?.short ?? commit.slice(0, 7),
+      builtAt: release?.builtAt ?? null,
+      release: release?.release ?? null,
+      dev: commit === "dev",
+      uptimeSeconds: Math.round(process.uptime()),
+    },
+    { headers: { "Cache-Control": "no-store" } },
+  );
+}