feat(deploy): prepare Render production launch

[SloppyBobbert]

Summary

• add a Render Blueprint for the Vite frontend, Dockerized Django API, and managed PostgreSQL
• run Django with Gunicorn/WhiteNoise and production environment settings
• contain Tectonic compilation with non-root execution, offline immutable cache seeding, resource limits, concurrency control, and request throttling
• configure production API routing, security headers, Docker context hygiene, and deployment guidance

Verification

• backend: 127 tests passed; task-scoped Ruff and Django deploy checks passed
• frontend: ESLint, 63 tests, and production build passed
• Docker: no-cache backend build verified Tectonic checksums; Compose health and PDF compile smoke tests passed
• configuration: Render YAML, Compose config, Gunicorn config, and diff checks passed

Operations note

Anonymous compile throttling uses the validated immediate peer address. Render does not document a trustworthy original-client-IP header, so hosted traffic may share the 10-attempt-per-minute bucket.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.