ops: add CI/CD pipeline, a/b rolling deploy, Gitea Actions workflow

- .gitea/workflows/deploy.yml — push-to-main triggers rolling deploy
- scripts/deploy-bluegreen.sh — a-stack then b-stack restart; Maven runs
  in Docker (no JDK needed on runner host); Caddy reload at end
- scripts/deploy-all.ps1 — emergency manual deploy from dev machine
- infra/docker-compose.yml — a/b pairs per service; wget health checks;
  Gitea service; Prometheus/Grafana/DB ports restricted to localhost
- infra/Caddyfile — dual upstreams with health-based routing
- infra/Dockerfile.* — one per service
- infra/prometheus.yml + grafana provisioning

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apix-registry/src/integration-test/resources/features/iot-transition/anonymity.feature

@@ -0,0 +1,35 @@
+Feature: Device owner anonymity guarantee
+  As an IoT device owner
+  I must be able to use the full transition discovery process
+  Without APIX storing or inferring any artefact that identifies me or my device
+
+  Background:
+    Given a deprecated service "SmartHub Cloud" with locked set to false
+    And at least one replacement candidate registered
+
+  Scenario: Status polling requires no authentication
+    When GET /services/{smartHubCloudId} is called with no Authorization header
+    Then the response is HTTP 200
+    And locked and sunset_date are present in the response body
+
+  Scenario: Replacement discovery requires no authentication
+    When GET /services/{smartHubCloudId}/replacements is called with no Authorization header
+    Then the response is HTTP 200
+    And the full replacement list is returned
+
+  Scenario: No session state is created during polling
+    When GET /services/{smartHubCloudId}/replacements is called twice with no shared headers
+    Then both responses are identical in content
+    And neither response contains a Set-Cookie header
+    And neither response contains a session reference
+
+  Scenario: Response contains no client-tracking artefacts
+    When GET /services/{smartHubCloudId}/replacements is called
+    Then the response headers contain no Set-Cookie
+    And the response body contains no field that echoes client request details
+    And the response body contains no correlation ID tied to the caller
+
+  Scenario: Polling endpoint is covered by the public cache
+    When GET /services/{smartHubCloudId}/replacements is called twice within the cache TTL
+    Then the second response is served from cache
+    And the cache key does not incorporate any client-identifying header