feat(deploy): add Contabo release workflow and portal payload gate

www/README.md

@@ -611,6 +611,16 @@ Verify matching output with
 use `--mode=indexing` for indexing output and `--forms=off` or `--forms=mock`
 for those explicit builds. No actual submissions run in automated tests.
 
+## Static releases and employee portal
+
+The Contabo deployment interface is intentionally separate from NixOS changes.
+Use [the release runbook](integrations/nixos/deploy.md) for `npm run deploy`,
+dry-run, rollback, the encrypted production portal input and the separate
+one-time employee-resource installer. Ordinary releases never copy employee
+documents into `dist`; protected staff and management resources remain under
+server-controlled Basic Auth namespaces. The accepted interim portal is
+explicitly non-PHI.
+
 ### Google Ads consultation-form conversion handoff
 
 The Google Ads conversion ID, label, and privacy-gated Astro integration