Add secure Render deployment

[beme08]

What changed

• add a Render Blueprint for one Docker web service in Frankfurt
• gate automatic deploys on passing GitHub checks
• generate the session secret in Render and keep GitHub credentials dashboard-only
• document the production URL and GitHub App callback
• upgrade Astro and the Node adapter past the known high/moderate production advisories

Validation

• npm run check
• 8 tests passed
• production build and HTTP smoke checks passed
• Docker image built successfully
• container liveness, readiness, and homepage checks passed
• production audit has no critical, high, or moderate advisories (3 low remain)