Enable beta auto-deploy on master; manual prod button (#26) (#30)

## Summary

Closes #26.

- Replace auto-prod `deploy.yml` with `deploy-beta.yml` (push to `master` → tests → `--env beta`) and `deploy-prod.yml` (`workflow_dispatch` only → `--env prod`), matching `dta_service` / `chat_web_app`
- Default `ALLOWED_HOSTS` / `CORS_ALLOWED_ORIGINS` include beta API + SPA hosts so beta frontend (and Tianji-instrumented pages) can call the API
- Expand `.env.prod.example` beta block (CORS, CSRF, OAuth callbacks, `FRONTEND_BASE_URL`, Tianji note)
- Harden `validate-env.sh` for beta secrets; README documents beta auto / prod button

## Tianji

Backend does not load `tracker.js`. FE already owns wiring (`chat_web_app#35`, closed).

- Beta SPA origin: `https://beta.chat.aimloperations.com`
- Beta Tianji website ID (FE `.env.beta`): `cms38bw671mf9n5jjw3xp1j3q`

## Coordination

- Infra: [server-infra#7](ai_ml_operations/server-infra#7) (`host_apps` beta `:8013`, `chat_backend_beta` DB, secret, NPM)
- FE companion: [chat_web_app#35](ai_ml_operations/chat_web_app#35)

## Test plan

- [ ] PR CI / unit tests green
- [ ] Merge to `master` triggers **Deploy Beta** only (not prod)
- [ ] Manual **Deploy Prod** `workflow_dispatch` still deploys `--env prod`
- [ ] After infra#7: beta container healthy on **8013** with `chat_backend_beta`
- [ ] Beta hosts / CSRF / CORS allow `https://beta.chat.aimloperations.com`Reviewed-on: #30

llm_be/chat_backend/tests/test_settings_cors.py

@@ -59,3 +59,11 @@ class CapacitorWebviewOriginTests(SimpleTestCase):
         from django.conf import settings
 
         self.assertFalse(settings.CORS_ALLOW_CREDENTIALS)
+
+    def test_default_cors_includes_beta_frontend(self):
+        from django.conf import settings
+
+        self.assertIn(
+            "https://beta.chat.aimloperations.com",
+            settings.CORS_ALLOWED_ORIGINS,
+        )

llm_be/llm_be/settings.py

@@ -122,7 +122,9 @@ DEBUG = env_bool("DJANGO_DEBUG", DJANGO_ENV == "dev")
 
 allowed_hosts = env_list(
     "DJANGO_ALLOWED_HOSTS",
-    "localhost,127.0.0.1,0.0.0.0,chatbackend.aimloperations.com,chat.aimloperations.com",
+    "localhost,127.0.0.1,0.0.0.0,"
+    "chatbackend.aimloperations.com,chat.aimloperations.com,"
+    "beta.chatbackend.aimloperations.com,beta.chat.aimloperations.com",
 )
 ALLOWED_HOSTS = allowed_hosts if allowed_hosts else ["*"]
 
@@ -139,7 +141,8 @@ CORS_ORIGIN_ALLOW_ALL = env_bool("CORS_ORIGIN_ALLOW_ALL", True)
 CORS_ALLOWED_ORIGINS = with_capacitor_webview_origins(
     env_list(
         "CORS_ALLOWED_ORIGINS",
-        "http://localhost:3000,http://127.0.0.1:3000,https://chat.aimloperations.com",
+        "http://localhost:3000,http://127.0.0.1:3000,"
+        "https://chat.aimloperations.com,https://beta.chat.aimloperations.com",
     )
 )