chore(sap): harden deploy reliability (paths + preflight + logs)

[Cheewye]

Summary

• Restrict v2 deploy triggers to code-relevant paths (no docs/workflow-only deploys)
• Add pre-flight SSH check for sudo NOPASSWD + repo dir before deploy
• Add stage markers + final OK/FAIL and non-fatal public /health check
• Add nginx redirect to silence /v1/metrics/persistence noise
• Add runtime map doc for Hetzner (health checks, routing, rollback)

Deploy triggers

• backend/, config/, deploy/, tools/, requirements.txt

Does NOT trigger deploy

• docs-only changes
• workflow edits alone

Hetzner requirements (NOPASSWD)

• /bin/systemctl daemon-reload
• /bin/systemctl restart iuri-backend
• /bin/systemctl --no-pager --full status iuri-backend