feat(deploy): add Contabo release workflow and portal payload gate

www/integrations/employee-portal/README.md

@@ -1,9 +1,25 @@
 # Employee portal compatibility and private migration
 
-Recorded 2026-10-30. Browser-side shared-code decryption is approved only for
-local compatibility development. It is not authentication, individual revocation,
-a secure session or a HIPAA compliance determination. Resources need separate
-server authorization before cutover.
+Recorded 2026-11-04. The clinical director accepted the collected, non-PHI
+staff and management portal content and the interim shared-code presentation.
+Browser-side decryption remains access friction rather than individual
+authentication, revocation, a secure session, or a HIPAA determination.
+
+## Approved production ciphertext
+
+An indexing-enabled production build may include one owner-approved encrypted
+two-stream payload when both of these non-public build inputs are set:
+
+```sh
+AIA_PORTAL_PRODUCTION_APPROVED=true
+AIA_PORTAL_PRODUCTION_CIPHERTEXT_FILE=/absolute/private/employee-portal/approved-production-ciphertext.json
+```
+
+The build rejects missing, malformed, symlinked, oversized, wrong-mode, or
+simultaneous local-preview/production inputs. It never decrypts the payload at
+build time. `/employee-portal` remains noindex, sitemap-excluded and
+hreflang-excluded. See [the deployment runbook](../nixos/deploy.md) for the
+approved release and protected-resource installation commands.
 
 ## Source and private collection