Enable beta auto-deploy on master; prod via manual button

Closes #26. Split deploy.yml into deploy-beta (push→master) and
deploy-prod (workflow_dispatch), wire beta hosts/CORS defaults, and
document beta secret + Tianji coordination with chat_web_app.

.env.prod.example

@@ -77,10 +77,27 @@ GUNICORN_BIND=0.0.0.0:8000
 
 # =============================================================================
 # BETA overrides (use separate file: chat_backend_beta.env)
+# Control node: ~/Documents/secrets/chat_backend/chat_backend_beta.env
+# Infra: server-infra#7 (host_apps beta :8013, Postgres chat_backend_beta, NPM)
 # =============================================================================
 # DJANGO_ENV=beta
+# DJANGO_DEBUG=false
 # DJANGO_SECRET_KEY=replace-with-a-different-beta-secret
 # DJANGO_ALLOWED_HOSTS=beta.chatbackend.aimloperations.com
+# Optional; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
+# DJANGO_CSRF_TRUSTED_ORIGINS=https://beta.chatbackend.aimloperations.com,https://beta.chat.aimloperations.com
+# CORS_ALLOWED_ORIGINS=https://beta.chat.aimloperations.com
+# CORS_ORIGIN_ALLOW_ALL=false
+# USE_TLS_PROXY=true
 # DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/chat_backend_beta
 # WEB_PORT=8013
 # OLLAMA_BASE_URL=http://10.0.0.128:11434
+# OAUTH_CALLBACK_BASE_URL=https://beta.chatbackend.aimloperations.com
+# FRONTEND_BASE_URL=https://beta.chat.aimloperations.com
+# Register beta OAuth redirect URIs in each IdP console:
+#   https://beta.chatbackend.aimloperations.com/api/auth/oauth/google/callback/
+#   https://beta.chatbackend.aimloperations.com/api/auth/oauth/microsoft/callback/
+#
+# Tianji: backend does not load tracker.js. Beta SPA uses a distinct website ID
+# (chat_web_app .env.beta REACT_APP_TIANJI_WEBSITE_ID). Ensure CORS allows the
+# beta frontend origin so Tianji-instrumented pages can call this API.