feat(ops): saker deploy-process - tools-container for migrera/seed + omskriven deploy.sh + runbook

- Dockerfile.tools + app-tools compose-tjanst (profile: tools): on-demand migrera/seed via tsx, kor aldrig som tjanst.
- deploy.sh omskriven: ratt gren (master), ratt sokvag (/opt/cibello-platform), riktig migrering via tools-container (ersatter trasig --migrate-only), bygger api+worker, healthcheck med automatisk rollback.
- RUNBOOK.md: deploy, recept-/sprak-uppdatering, migreringar, rollback, admin.

Co-Authored-By: Claude <noreply@anthropic.com>

infrastructure/docker/docker-compose.production.yml

@@ -95,6 +95,20 @@ services:
           cpus: "0.5"
           memory: 640M
 
+  # app-tools: on-demand ops-container för db-migreringar + seed. Startar INTE med
+  # `up` (profile: tools). Körs via:
+  #   docker compose -f <compose> --profile tools run --rm app-tools tsx packages/database/src/migrate.ts
+  #   docker compose -f <compose> --profile tools run --rm app-tools tsx packages/database/src/seed/run.ts
+  app-tools:
+    build:
+      context: ../..
+      dockerfile: infrastructure/docker/Dockerfile.tools
+    image: app-tools:latest
+    container_name: app-tools
+    env_file: /opt/app-platform/secrets/api.env
+    profiles: ["tools"]
+    restart: "no"
+
 # PostgreSQL: befintlig RDS-instans med separat separat databas och
 # användaren app-användaren med minsta möjliga privilegier (spec §52).
 # Se infrastructure/deployment/create-database.sql.