feat(deploy): add Contabo release workflow and portal payload gate

www/integrations/nixos/README.md

@@ -63,10 +63,10 @@ Test direct requests, alternate encodings, role crossover and rollback.
 - Portal HTML: shared-code browser decryption, offline-guessable access friction.
 - Documents: require server authorization even if URLs are encrypted in the UI.
 
-The compatibility preview cannot grant production portal access. Before cutover,
-classify every document, implement and verify its delivery destination, rewrite
-and re-encrypt links, test two-view separation, rotate shared codes privately,
-check the public artifact for private files, and obtain owner/security approval.
-Back up encrypted configuration and documents separately from keys; rehearse
-restore and rollback. Revoking a static release cannot retract ciphertext or
-files already downloaded by visitors. Site cutover is still unauthorized.
+The approved production portal build uses a non-public encrypted two-stream
+payload and retains the same browser-side decryption boundary. Approved non-PHI
+documents install separately into the VPS-owned staff/management directories;
+they are never copied into `dist`. Verify both protected namespaces, two-view
+separation, artifact exclusions, code rotation, restore and rollback before
+cutover. Revoking a static release cannot retract ciphertext or files already
+downloaded by visitors. Site cutover remains separately authorized.