Infra: split dev and production (releases, services, deploy script)

- Production now runs from ~/freezmo-prod/current (release symlink) as a
  standalone server on :3207; releases are exported by scripts/deploy.sh,
  built and e2e-verified on a temp port, switched atomically, health-
  checked via the new /api/healthz (commit + build time) and rolled back
  automatically on failure. Last 5 releases kept; scripts/rollback.sh for
  manual rollback. Shared env + data live in ~/freezmo-prod/shared/ and
  are symlinked into every release (existing sync/push data migrated and
  verified identical).
- Dev runs from ~/freezmo via freezmo-dev.service: next dev on :3217
  (LAN only), its own build folder (.next-dev via NEXT_DIST_DIR), its own
  data (~/freezmo/.freezmo-dev), DEV badge, dev favicon/theme colour,
  "Freezmo Dev" PWA identity and never the production service worker.
- /api/healthz + the Settings Details version row (short commit + build
  time). output: standalone in next.config (next start still works).
- AGENTS.md documents the workflow rules: only dev updates during a task,
  temporary dirs/ports for test builds, and deploy-at-the-end as the only
  production path. README gains an Environments and deploy section.
- Fix found by the rehearsal: lib/dev-mode.ts must not be a client module
  (a server component importing a constant from a "use client" module
  gets a truthy proxy, which baked dev metadata into production builds).
- SW -> freezmo-v34.

deploy/freezmo-dev.service

@@ -0,0 +1,40 @@
+[Unit]
+# Freezmo — dev instance (hot reload, LAN only).
+#
+# This is the working tree (~/freezmo). Everything live happens here: edits are
+# visible within seconds, its build folder is .next-dev (a production build can
+# never clobber it) and its data lives in ~/freezmo/.freezmo-dev, so test
+# shares, sync blobs and rate limits never touch production data.
+#
+# It binds the LAN so the phone can reach it, but nothing routes this port
+# through the public proxy — production stays the only public instance.
+# It shows a DEV badge, uses a dev favicon/theme colour, installs as
+# "Freezmo Dev" (separate origin, separate storage) and never registers the
+# production service worker.
+#
+# Install (per user, no root needed):
+#   cp ~/freezmo/deploy/freezmo-dev.service ~/.config/systemd/user/
+#   systemctl --user daemon-reload
+#   systemctl --user enable --now freezmo-dev.service
+# Logs:  journalctl --user -u freezmo-dev -f
+Description=Freezmo dev instance (hot reload, LAN only)
+Documentation=file://%h/freezmo/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=%h/freezmo
+Environment=NEXT_TELEMETRY_DISABLED=1
+Environment=NEXT_DIST_DIR=.next-dev
+Environment=NEXT_PUBLIC_FREEZMO_DEV=1
+Environment=SYNC_DIR=%h/freezmo/.freezmo-dev/sync
+Environment=PUSH_DIR=%h/freezmo/.freezmo-dev/push
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/bin/node %h/freezmo/node_modules/next/dist/bin/next dev -H 0.0.0.0 -p 3217
+Restart=always
+RestartSec=2
+TimeoutStartSec=0
+
+[Install]
+WantedBy=default.target