feat: replace EC2 deploy with GCP Compute Engine

[manNomi]

Summary

• Moves production deployment from AWS EC2 to a GCP Compute Engine VM (soundlog-api, project nomi-app-deploy-2026, asia-northeast3-a) running the same Postgres + API Docker Compose stack.
• Adds a caddy container that terminates HTTPS for api.soundlog.shop directly on the VM with an auto-issued Let's Encrypt certificate, replacing the EC2-era Vercel-proxy-for-HTTPS setup.
• Adds .github/workflows/deploy-gcp.yml (SSH-based deploy, same shape as the old EC2 workflow) and docs/gcp-deployment.md; removes deploy-ec2.yml and docs/ec2-deployment.md.
• New GitHub secrets (GCP_HOST, GCP_USER, GCP_SSH_PORT, GCP_SSH_KEY, GCP_APP_DIR, PRODUCTION_ENV) are already set on this repo, and deploy-gcp.yml has already been run and verified successfully against the new VM (db + api + caddy containers healthy, /v1/health OK, node scripts/check-public-api-contract.mjs passed).

Manual step required (blocking public HTTPS)

Add this DNS record in Gabia DNS:

Type	Host	Value
A	api	34.64.116.40

https://api.soundlog.shop will not work until this resolves — Caddy can't issue a cert without it. Everything else (internal health, contract check) is already verified working.

Related

• SoundLogApp PR: feat: point app at GCP api.soundlog.shop origin SoundLogApp#21 (updates EXPO_PUBLIC_SOUNDLOG_API_BASE_URL to https://api.soundlog.shop and fixes the Vercel build's stale-origin guard, which had api.soundlog.shop deny-listed from an earlier iteration)
• SOUNDLOG_API_ORIGIN on the sound-log-app Vercel project has already been updated to https://api.soundlog.shop for Production/Preview — the next web deploy needs SoundLogApp#21 merged first (see that PR for why).

Not done (needs a human)

• TOUR_API_SERVICE_KEY ships blank in the new PRODUCTION_ENV secret — set the real data.go.kr key if that feature needs to work.
• The old EC2 instance was already shut down (no data migration needed), but the actual AWS resource still needs to be terminated in the AWS console — no working AWS credentials were available here to do it.

Test plan

• deploy-gcp.yml run manually from this branch, all steps green
• docker compose ps on the VM: db/api/caddy all healthy
• node scripts/check-public-api-contract.mjs passed inside the deployed container
• curl https://api.soundlog.shop/v1/health after the Gabia DNS record is added
• Delete old EC2_*/AWS_* GitHub secrets once this is merged and confirmed stable

🤖 Generated with Claude Code

[manNomi]

남은 할 일 (TODO)

• Gabia DNS: api.soundlog.shop A 레코드 → 34.64.116.40 추가 (없으면 Caddy가 Let's Encrypt 인증서를 못 받아서 HTTPS가 동작하지 않음)
• 이 PR과 SoundLogApp#21 리뷰 후 머지 (두 PR이 함께 적용되어야 앱/웹이 새 origin으로 정상 동작)
• 머지 + DNS 반영 후 curl https://api.soundlog.shop/v1/health로 최종 확인
• TOUR_API_SERVICE_KEY 실제 값 필요 시 gh secret set TOUR_API_SERVICE_KEY --repo SoundLogTeam/SoundLogServer로 PRODUCTION_ENV에 반영 (현재 빈 값)
• AWS 콘솔에서 기존 EC2 인스턴스 종료 (여기서는 AWS 자격증명이 없어서 직접 처리 못함)

검증 완료

• deploy-gcp.yml 수동 트리거로 실제 배포 성공 (db/api/caddy 컨테이너 healthy)
• node scripts/check-public-api-contract.mjs 컨테이너 내부에서 통과
• pnpm typecheck, pnpm check:openapi-sync 통과
• pnpm test:api — 1건 실패(handles recap APIs)했지만 main 브랜치에서도 동일하게 실패하는 기존 결함으로 확인, 이 PR 변경사항과 무관
• EC2/AWS 관련 GitHub 시크릿 전부 삭제 완료 (AWS_REGION, EC2_APP_DIR, EC2_HOST, EC2_SECURITY_GROUP_ID, EC2_SSH_KEY, EC2_SSH_PORT, EC2_USER)