Add deployment, authentication, and persistence end-to-end verification

[franciscojavierarceo]

Parent: #102

Create a verification matrix for the hosted deployment architecture.

Scope:

• Container startup and health/readiness checks.
• PostgreSQL initialization and restart persistence.
• OIDC/GitHub login and invalid-token rejection.
• API-key creation, use, scope enforcement, expiration, and revocation.
• Cross-user/tenant isolation.
• HTTP streaming and WebSocket behavior behind a reverse proxy/ingress.
• Secret leakage and log-safety checks.

Acceptance: the deployment can be validated repeatably before release on both a local container stack and at least one hosted target.

See the parent issue: #102