chore: cloud deploy pipeline (Vercel web + Render API + bot VM) and env template consolidation

[dzhhem]

Description

Adds a reproducible, documented cloud deployment path for all three apps and
aligns the env templates and docs with it.

• Web (Vercel): documented in README (Web Vercel Deploy Setup) — no committed
  Blueprint, since Vercel keeps project settings and secrets in the dashboard,
  not in vercel.json (strict JSON, routing only). Covers Root Directory,
  dashboard env vars, the /FinTrack basePath, and the API-side CORS_ORIGINS /
  FRONTEND_URL alignment. vercel.json itself is unchanged.
• API (Render): new render.yaml Blueprint provisions fintrack-api
  (Docker runtime, /api/health check, autoDeploy: true). Every secret is
  sync: false — values are set in the Render dashboard, never committed.
• Bot (Oracle VM): new deploy-bot job in release.yml runs after the
  image build + Trivy scan, SSHes into the VM (appleboy/ssh-action), pulls
  ghcr.io/fintrack-team/fintrack-bot:latest, and recreates the fintrack-bot
  container (--restart unless-stopped, --env-file ~/bot.env). A push-based
  deploy gated on a green build, instead of a Watchtower polling setup.
• Env templates: consolidated .env*.example headers with an explicit
  REQUIRED / REQUIRED IN PRODUCTION / OPTIONAL legend, randomBytes generation
  hints for secrets, and a render.yaml mirror note in apps/api/.env.example.
  Weak placeholder secrets replaced with format placeholders (<64-byte-hex>).
• Docs: README.md gains a Web Vercel Deploy Setup runbook, the Render
  Blueprint deploy note, and a Bot VM Deploy Setup runbook (Docker install,
  ~/bot.env, CI deploy key, repo secrets, firewall, per-operator SSH access);
  CONTRIBUTING.md cross-references the VM runbook from the env-files table.

New repo secrets required for the bot deploy: VM_HOST, VM_USER, VM_SSH_KEY.

Closes #102

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)

How Has This Been Tested?

• Unit tests (Jest/Vitest)

• Integration tests

• Manual testing (screenshots/screencasts encouraged)

• CI release.yml build + Trivy scan pass for api/web/bot images.

• render.yaml and the deploy-bot job were reviewed for correctness; the live
  Render Blueprint deploy and the VM bot deploy are verified post-merge (first
  push to master after the secrets are set).

• .env*.example files reviewed — no real secrets, placeholders only; ToC
  freshness check passes for README and CONTRIBUTING.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have documented non-obvious behavior or constraints where necessary
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules
• (If API) Database migrations have been created and tested
• (If UI) Changes look good on mobile and desktop