Reconcile the `production` branch with the actual services deploy source

[cofade]

@schutera — surfaced while documenting the OTA release process (#151). The firmware-OTA side is now covered; this is the one unresolved operational question it exposed, and it's yours to decide.

Situation

The deployment docs say the web services deploy from the production branch (docs/07-deployment-view/production-deployment.md, production-runbook.md), but that branch no longer matches what's live:

• origin/production is 151 commits behind main and 25 ahead (divergent history), last touched 2026-05-02 (bf8b314).
• Live prod is demonstrably running main-only code: the security: production API key is baked into the public JS bundle; admin login gate is health-only #142 admin session (backend/src/session.ts / POST /api/admin/login) exists on main, is absent on production, and responds in production.

So the documented services deploy source ≠ reality.

Why it matters

The services deploy source is ambiguous, and the new OTA release runbook's publish step (rebuild the frontend image) rides this same track — so the ambiguity leaks into firmware releases too. Firmware-OTA versioning itself is unaffected (it's cut on main + prod-* tags).

Options — pick one

1. Adopt main as the services deploy source (matches reality). Update the two deploy docs to clone/pull main; archive or delete production. → First confirm the 25 commits unique to production are obsolete / already squashed into main and nothing is genuinely unmerged.
2. Keep production as the deploy branch. Fast-forward it onto main now and make "update production" a step in every services deploy. → Same caveat: review the 25 divergent commits first.
3. production is an intentional staging / release-gated branch. Then document the promotion gate and why it lags — though the current evidence (prod running main-only security: production API key is baked into the public JS bundle; admin login gate is health-only #142) argues against this.

Ask

Which model is actually in use? Once you pick, I can do the doc updates and/or the branch cleanup.

Until then, the runbook and the chapter-11 entry both carry a "verify your actual deploy source before relying on this" hedge — this issue is what gives that hedge a finite lifespan.

Refs: docs/07-deployment-view/firmware-release.md → "Git: branch & tag model"; docs/11-risks-and-technical-debt/README.md → "production branch drifted from the deployed services"; #151.

[cofade]

@schutera Do we still need the production branch? It's quite outdated, and have been effectively releasing from main.