Closes #26. Split deploy.yml into deploy-beta (push→master) and deploy-prod (workflow_dispatch), wire beta hosts/CORS defaults, and document beta secret + Tianji coordination with chat_web_app.