Infra: split dev and production (releases, services, deploy script)

- Production now runs from ~/freezmo-prod/current (release symlink) as a
  standalone server on :3207; releases are exported by scripts/deploy.sh,
  built and e2e-verified on a temp port, switched atomically, health-
  checked via the new /api/healthz (commit + build time) and rolled back
  automatically on failure. Last 5 releases kept; scripts/rollback.sh for
  manual rollback. Shared env + data live in ~/freezmo-prod/shared/ and
  are symlinked into every release (existing sync/push data migrated and
  verified identical).
- Dev runs from ~/freezmo via freezmo-dev.service: next dev on :3217
  (LAN only), its own build folder (.next-dev via NEXT_DIST_DIR), its own
  data (~/freezmo/.freezmo-dev), DEV badge, dev favicon/theme colour,
  "Freezmo Dev" PWA identity and never the production service worker.
- /api/healthz + the Settings Details version row (short commit + build
  time). output: standalone in next.config (next start still works).
- AGENTS.md documents the workflow rules: only dev updates during a task,
  temporary dirs/ports for test builds, and deploy-at-the-end as the only
  production path. README gains an Environments and deploy section.
- Fix found by the rehearsal: lib/dev-mode.ts must not be a client module
  (a server component importing a constant from a "use client" module
  gets a truthy proxy, which baked dev metadata into production builds).
- SW -> freezmo-v34.

deploy/freezmo.service

@@ -1,13 +1,21 @@
 [Unit]
-# Freezmo — self-hosted notes-to-study-feed app.
+# Freezmo — production release (self-hosted study app).
+#
+# Runs the "current" release symlink: scripts/deploy.sh atomically flips it and
+# restarts this unit, so production only ever runs a pushed, verified commit.
+# Layout: ~/freezmo-prod/{releases/<name>,current -> releases/<name>,shared}
+#   current/server/server.js   standalone Next server (built by the deploy)
+#   current/server/.env.local  -> shared/env.local
+#   current/server/.freezmo    -> shared/freezmo   (sync/, push/)
+#
 # Install (per user, no root needed):
 #   mkdir -p ~/.config/systemd/user
-#   cp deploy/freezmo.service ~/.config/systemd/user/
+#   cp ~/freezmo/deploy/freezmo.service ~/.config/systemd/user/
 #   systemctl --user daemon-reload
 #   systemctl --user enable --now freezmo.service
 #   loginctl enable-linger "$USER"     # start at boot without logging in
 # Logs:  journalctl --user -u freezmo -f
-Description=Freezmo (self-hosted study app)
+Description=Freezmo (self-hosted study app, production)
 Documentation=file://%h/freezmo/README.md
 After=network-online.target
 Wants=network-online.target
@@ -16,15 +24,19 @@ After=ollama.service
 
 [Service]
 Type=simple
-WorkingDirectory=%h/freezmo
+# The standalone server keeps its own cwd; the release carries shared env/data
+# as symlinks, and EnvironmentFile is the belt to that pair of braces.
+WorkingDirectory=%h/freezmo-prod/current/server
 Environment=NODE_ENV=production
 Environment=NEXT_TELEMETRY_DISABLED=1
+Environment=PORT=3207
+Environment=HOSTNAME=0.0.0.0
 Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-# Refuse to start without a production build — clearer than next crashing in a
-# restart loop. Run `npm run build` in %h/freezmo first.
-AssertPathExists=%h/freezmo/.next/BUILD_ID
-# Next.js loads .env.local (OLLAMA_*) from the working directory itself.
-ExecStart=/bin/node %h/freezmo/node_modules/next/dist/bin/next start -H 0.0.0.0 -p 3207
+EnvironmentFile=-%h/freezmo-prod/shared/env.local
+# Refuse to start without a release — clearer than next crashing in a restart
+# loop. Run scripts/deploy.sh (from %h/freezmo) first.
+AssertPathExists=%h/freezmo-prod/current/server/server.js
+ExecStart=/bin/node %h/freezmo-prod/current/server/server.js
 Restart=always
 RestartSec=3
 TimeoutStartSec=0