feat: add production deployment baseline

deploy/production/README.md

@@ -0,0 +1,37 @@
+# Production deployment
+
+This compose project runs the Search API and its private OpenSearch node. It
+binds the API only to `127.0.0.1`; publish it through an authenticated reverse
+proxy or VPN. OpenSearch is not published outside the compose network.
+
+The current compose intentionally disables the OpenSearch security plugin to
+match the existing API client. Keep both services on a private host/network
+until authenticated OpenSearch support is implemented.
+
+## First deployment
+
+1. Copy this directory to the host with the repository source.
+2. Copy `.env.example` to `.env`, set an absolute `DATA_ROOT`, and replace
+   `REVIEW_SECRET` with a random value. Do not commit `.env`.
+3. Put the normalized dataset under `$DATA_ROOT/minjust-normalized/`.
+4. Check the rendered configuration:
+
+   ```bash
+   docker compose --env-file .env -f compose.yaml config
+   ```
+
+5. Start the services:
+
+   ```bash
+   docker compose --env-file .env -f compose.yaml up -d --build
+   docker compose --env-file .env -f compose.yaml ps
+   curl -fsS http://127.0.0.1:${BACKEND_PORT:-8080}/review >/dev/null
+   ```
+
+6. Load the versioned index and switch its alias only after the import and
+   validation succeed. Back up `DATA_ROOT` and the `opensearch-data` volume
+   before the first import.
+
+This is a deployment baseline, not a public internet exposure recipe. TLS,
+authentication, backups, monitoring, and a production OpenSearch security
+configuration must be provided by the host reverse proxy/operations setup.