Enable beta auto-deploy on master; prod via manual button

Closes #26. Split deploy.yml into deploy-beta (push→master) and
deploy-prod (workflow_dispatch), wire beta hosts/CORS defaults, and
document beta secret + Tianji coordination with chat_web_app.

scripts/validate-env.sh

@@ -44,9 +44,11 @@ if ((${#missing[@]} > 0)); then
   exit 1
 fi
 
-if [[ "$DJANGO_ENV" == "prod" && ( "$DJANGO_SECRET_KEY" == change-me* || "$DJANGO_SECRET_KEY" == *dev-only* ) ]]; then
-  echo "DJANGO_SECRET_KEY must be changed from the example value for production." >&2
-  exit 1
+if [[ "$DJANGO_ENV" == "prod" || "$DJANGO_ENV" == "beta" ]]; then
+  if [[ "$DJANGO_SECRET_KEY" == change-me* || "$DJANGO_SECRET_KEY" == *dev-only* || "$DJANGO_SECRET_KEY" == django-insecure* ]]; then
+    echo "DJANGO_SECRET_KEY must be a real secret for $DJANGO_ENV (not an example/dev value)." >&2
+    exit 1
+  fi
 fi
 
 echo "Environment validation passed (DJANGO_ENV=$DJANGO_ENV)."