ci: implement PR-gated CI/CD pipeline

[sanket-rajput]

Changes

• Separate CI and production deployment workflows
• Run CI only on pull requests targeting main
• Deploy only after merge to main
• Deploy the exact merged commit SHA to EC2
• Add Docker image build validation
• Bootstrap the EC2 repository on first deployment
• Add post-deployment Actuator health verification

CI validation

• Java 21
• Maven clean verify
• Unit tests
• Testcontainers integration tests
• JaCoCo coverage artifact
• Backend Docker build
• Frontend Docker build

Deployment

Production deployment runs only after merge into main. The deployment workflow checks out the exact merged commit SHA, rebuilds the Docker Compose stack on EC2, and verifies /actuator/health.