Add deploy/publish.sh redeploy helper + document production split

One command to rebuild the frontend, sync it to the live Caddy site, refresh the
API container, and reload Caddy. README documents the upbeatbytes.com topology.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -197,6 +197,19 @@ docker run -p 8000:8000 -v /srv/goodnews/data:/data goodnews
 `GOODNEWS_DB` controls the database path (defaults to `data/goodnews.sqlite3`).
 Put a reverse proxy (Caddy/nginx) in front for TLS once a domain is attached.
 
+### Production (upbeatbytes.com)
+
+Live deployment splits the two halves:
+
+- **Static site** served by Caddy from `/home/jay/srv/sites/upbeatbytes`.
+- **API** runs as a read-only container (`/home/jay/srv/upbeatbytes/compose.yaml`)
+  on Caddy's `caddy_web` network; Caddy proxies `/api/*`, `/healthz`, `/docs` to it.
+  It mounts the host database (written by the ingestion timer) and only reads it.
+- **Ingestion** stays on the host `goodnews.timer` systemd unit.
+
+Redeploy after changes with `deploy/publish.sh` (builds the frontend, syncs it to
+the live folder, rebuilds the API container, reloads Caddy).
+
 ## Scheduling
 
 A single idempotent command runs the whole pipeline and is safe to invoke as