feat(web): vercel deployment and vds compose/systemd setup

Add Vercel config with React Router preset, vercel-build script and
/api/auth rewrite to the Convex site. Add VDS staging compose for the
Rivet engine and runner plus systemd units, deployment plan, and
Docker/Vercel ignore rules. Lockfile covers both the web and agents
dependency additions.

deploy/systemd/Caddyfile

@@ -0,0 +1,18 @@
+{
+	email ops@zopu.ai
+}
+{$AGENTS_HOST} {
+	encode zstd gzip
+
+	route {
+		reverse_proxy /agents/zopu/* 127.0.0.1:3000
+		reverse_proxy /internal/work-attempts/* 127.0.0.1:3000
+		reverse_proxy /api/rivet/* 127.0.0.1:3000
+		reverse_proxy /workflows/* 127.0.0.1:3000
+		reverse_proxy /health 127.0.0.1:3000
+		respond 404
+	}
+}
+:80 {
+	redir https://{host}{uri} permanent
+}

deploy/systemd/zopu-agents.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=Zopu agent registry
+After=docker.service network-online.target
+Requires=docker.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=zopu
+Group=zopu
+WorkingDirectory=/srv/zopu/source/packages/agents
+EnvironmentFile=/etc/zopu/agents.env
+ExecStart=/opt/zopu/node/bin/node dist/server.mjs
+Restart=always
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+ProtectHome=true
+ReadWritePaths=/srv/zopu/workspaces
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/zopu-caddy.service.conf

@@ -0,0 +1,4 @@
+[Service]
+EnvironmentFile=/etc/zopu/agents.env
+ExecStart=
+ExecStart=/usr/bin/caddy run --config /etc/caddy/Caddyfile