Upgrade the image CA store and certifi to 2026.10.23 so forged certificates chaining to emSign ECC Root CA - G3 are rejected.
Unignore site/ (was blocked by mkdocs /site rule), add compose/Docker/uv tooling, and split deploys so push to main goes to beta while prod stays manual.