feat(web): vercel deployment and vds compose/systemd setup

Add Vercel config with React Router preset, vercel-build script and
/api/auth rewrite to the Convex site. Add VDS staging compose for the
Rivet engine and runner plus systemd units, deployment plan, and
Docker/Vercel ignore rules. Lockfile covers both the web and agents
dependency additions.

.gitignore

@@ -55,3 +55,24 @@ coverage
 tmp
 temp
 .env.*
+.env*
+infra/ansible/.gitignore
+infra/ansible/ansible.cfg
+infra/ansible/README.md
+infra/ansible/requirements.yml
+infra/ansible/group_vars/staging_vds.example/main.yml
+infra/ansible/group_vars/staging_vds.example/vault.yml
+infra/ansible/inventory/hosts.example.yml
+infra/ansible/playbooks/converge.yml
+infra/ansible/roles/backup/handlers/main.yml
+infra/ansible/roles/backup/tasks/main.yml
+infra/ansible/roles/backup/templates/zopu-backup.service.j2
+infra/ansible/roles/backup/templates/zopu-backup.sh.j2
+infra/ansible/roles/backup/templates/zopu-backup.timer.j2
+infra/ansible/roles/common/tasks/main.yml
+infra/ansible/roles/directories/tasks/main.yml
+infra/ansible/roles/docker/handlers/main.yml
+infra/ansible/roles/docker/tasks/main.yml
+infra/ansible/roles/docker/vars/main.yml
+infra/ansible/roles/firewall/handlers/main.yml
+infra/ansible/roles/firewall/tasks/main.yml