Implement Phase 10: deployment (Dockerfile, systemd, install script)

- Multi-stage Dockerfile: golang:1.25-alpine builder, alpine:3.21 runtime
  CGO_ENABLED=0, stripped binary, non-root user
- systemd: service unit (hardened), backup oneshot, daily timer (02:00 UTC)
- Install script: create user, dirs, config, install units
- Updated PROGRESS.md with all completed phases

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/systemd/eng-pad-server-backup.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Engineering Pad Server Backup
+
+[Service]
+Type=oneshot
+User=engpad
+Group=engpad
+ExecStart=/usr/local/bin/eng-pad-server snapshot -c /srv/eng-pad-server/eng-pad-server.toml

deploy/systemd/eng-pad-server-backup.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Daily Engineering Pad Server Backup
+
+[Timer]
+OnCalendar=*-*-* 02:00:00
+RandomizedDelaySec=300
+
+[Install]
+WantedBy=timers.target

deploy/systemd/eng-pad-server.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=Engineering Pad Server
+After=network.target
+
+[Service]
+Type=simple
+User=engpad
+Group=engpad
+ExecStart=/usr/local/bin/eng-pad-server server -c /srv/eng-pad-server/eng-pad-server.toml
+Restart=on-failure
+RestartSec=5
+
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+ReadWritePaths=/srv/eng-pad-server
+
+[Install]
+WantedBy=multi-user.target