Add production deployment guide and harden compose for it

- docker-compose.yml: bind client/server ports to 127.0.0.1 only — the
  client container is the sole intended public entry point (it proxies
  /api/* to the server itself), a host-level nginx sits in front of it in
  production. Client__Origin now configurable via CLIENT_ORIGIN env var.
- docs/DEPLOY.md: step-by-step for a fresh Linux target (Docker install,
  clone, .env secrets, nginx + certbot).
- docs/CI-CD.md: runner registration for that same target machine, in
  "host" mode so the deploy step's `docker compose up -d` acts on the
  actual running stack.

docker-compose.yml

@@ -21,23 +21,27 @@ services:
     environment:
       ConnectionStrings__Postgres: "Host=postgres;Port=5432;Database=quizsystem;Username=quizsystem;Password=${POSTGRES_PASSWORD:-devpassword}"
       Jwt__Secret: ${JWT_SECRET:?Set JWT_SECRET in .env — see .env.example}
-      Client__Origin: "http://localhost:8081"
+      Client__Origin: ${CLIENT_ORIGIN:-http://localhost:8081}
       ASPNETCORE_ENVIRONMENT: Production
     depends_on:
       postgres:
         condition: service_healthy
-    # Mapped to the same host port the client's hardcoded
-    # Client/Shared/JsonWire.fs `serverUrl` already expects — the browser
-    # (not any container) is what resolves "localhost:5144", so this keeps
-    # that working unmodified for local/dev use of the compose stack.
-    ports: ["5144:8080"]
+    # Bound to loopback only: the client container is the sole public entry
+    # point (it proxies /api/* to this service itself — see
+    # src/Client/nginx.conf), so nothing outside this host needs to reach
+    # the API directly. Still published on localhost for local debugging.
+    ports: ["127.0.0.1:5144:8080"]
     networks: [quizsystem]
 
   client:
     build:
       context: .
       dockerfile: src/Client/Dockerfile
-    ports: ["8081:80"]
+    # Loopback-only in production, where a host-level nginx (TLS + the real
+    # domain) is the actual public entry point and proxies here — see
+    # docs/DEPLOY.md. For local `docker compose up`, still reachable at
+    # http://localhost:8081 same as before.
+    ports: ["127.0.0.1:8081:80"]
     networks: [quizsystem]
 
 volumes: