Enable beta auto-deploy on master; manual prod button (#26) (#30)

## Summary

Closes #26.

- Replace auto-prod `deploy.yml` with `deploy-beta.yml` (push to `master` → tests → `--env beta`) and `deploy-prod.yml` (`workflow_dispatch` only → `--env prod`), matching `dta_service` / `chat_web_app`
- Default `ALLOWED_HOSTS` / `CORS_ALLOWED_ORIGINS` include beta API + SPA hosts so beta frontend (and Tianji-instrumented pages) can call the API
- Expand `.env.prod.example` beta block (CORS, CSRF, OAuth callbacks, `FRONTEND_BASE_URL`, Tianji note)
- Harden `validate-env.sh` for beta secrets; README documents beta auto / prod button

## Tianji

Backend does not load `tracker.js`. FE already owns wiring (`chat_web_app#35`, closed).

- Beta SPA origin: `https://beta.chat.aimloperations.com`
- Beta Tianji website ID (FE `.env.beta`): `cms38bw671mf9n5jjw3xp1j3q`

## Coordination

- Infra: [server-infra#7](ai_ml_operations/server-infra#7) (`host_apps` beta `:8013`, `chat_backend_beta` DB, secret, NPM)
- FE companion: [chat_web_app#35](ai_ml_operations/chat_web_app#35)

## Test plan

- [ ] PR CI / unit tests green
- [ ] Merge to `master` triggers **Deploy Beta** only (not prod)
- [ ] Manual **Deploy Prod** `workflow_dispatch` still deploys `--env prod`
- [ ] After infra#7: beta container healthy on **8013** with `chat_backend_beta`
- [ ] Beta hosts / CSRF / CORS allow `https://beta.chat.aimloperations.com`Reviewed-on: #30

.env.prod.example

@@ -77,10 +77,27 @@ GUNICORN_BIND=0.0.0.0:8000
 
 # =============================================================================
 # BETA overrides (use separate file: chat_backend_beta.env)
+# Control node: ~/Documents/secrets/chat_backend/chat_backend_beta.env
+# Infra: server-infra#7 (host_apps beta :8013, Postgres chat_backend_beta, NPM)
 # =============================================================================
 # DJANGO_ENV=beta
+# DJANGO_DEBUG=false
 # DJANGO_SECRET_KEY=replace-with-a-different-beta-secret
 # DJANGO_ALLOWED_HOSTS=beta.chatbackend.aimloperations.com
+# Optional; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
+# DJANGO_CSRF_TRUSTED_ORIGINS=https://beta.chatbackend.aimloperations.com,https://beta.chat.aimloperations.com
+# CORS_ALLOWED_ORIGINS=https://beta.chat.aimloperations.com
+# CORS_ORIGIN_ALLOW_ALL=false
+# USE_TLS_PROXY=true
 # DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/chat_backend_beta
 # WEB_PORT=8013
 # OLLAMA_BASE_URL=http://10.0.0.128:11434
+# OAUTH_CALLBACK_BASE_URL=https://beta.chatbackend.aimloperations.com
+# FRONTEND_BASE_URL=https://beta.chat.aimloperations.com
+# Register beta OAuth redirect URIs in each IdP console:
+#   https://beta.chatbackend.aimloperations.com/api/auth/oauth/google/callback/
+#   https://beta.chatbackend.aimloperations.com/api/auth/oauth/microsoft/callback/
+#
+# Tianji: backend does not load tracker.js. Beta SPA uses a distinct website ID
+# (chat_web_app .env.beta REACT_APP_TIANJI_WEBSITE_ID). Ensure CORS allows the
+# beta frontend origin so Tianji-instrumented pages can call this API.