feat(deploy): add a one-command production deploy in shell

Production had no orchestrator at all and its provisioning script required
PowerShell 7 on the server. up.sh now does the whole thing in POSIX shell:
it refuses to start until .env.prod and the origin certificate are in place,
generates the stream keys, brings up the infrastructure and the edge,
provisions Zitadel, applies the migrations and finally builds and starts the
applications. It is idempotent, so the same command deploys a new version.

provision.sh replaces provision.prod.ps1 (curl + jq) and also creates the web
player client, and migrate.prod.sh moves to scripts/migrate.sh reading the env
file with a parser instead of sourcing it as a shell script.

deploy/scripts/stream-keys.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# Generates the RS256 key pair used to sign (API) and verify (Gateway) stream
+# tickets. No-op if both keys already exist.
+set -eu
+
+KEYS_DIR=${1:?usage: stream-keys.sh <keys-dir>}
+PRIVATE_KEY="$KEYS_DIR/stream_private.pem"
+PUBLIC_KEY="$KEYS_DIR/stream_public.pem"
+
+if [ -f "$PRIVATE_KEY" ] && [ -f "$PUBLIC_KEY" ]; then
+    echo "Stream-ticket keys already present in $KEYS_DIR"
+    exit 0
+fi
+
+mkdir -p "$KEYS_DIR"
+openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$PRIVATE_KEY" 2>/dev/null
+openssl rsa -in "$PRIVATE_KEY" -pubout -out "$PUBLIC_KEY" 2>/dev/null
+chmod 644 "$PUBLIC_KEY"
+chmod 600 "$PRIVATE_KEY"
+
+echo "Generated stream-ticket keys in $KEYS_DIR"