fix: parallel CD trigger, remove env blocker, cleanup release pipeline

DEPLOYMENT.md

@@ -1,5 +1,33 @@
 # Deployment Guide
 
+## Table of Contents
+
+- [Deployment Guide](#deployment-guide)
+  - [Table of Contents](#table-of-contents)
+  - [Environments](#environments)
+  - [Production Target (Hetzner)](#production-target-hetzner)
+    - [Planned Infrastructure](#planned-infrastructure)
+    - [Cutover Plan](#cutover-plan)
+    - [Firewall / Security Group](#firewall--security-group)
+    - [Pipeline Readiness](#pipeline-readiness)
+  - [Target Topology](#target-topology)
+  - [Prerequisites](#prerequisites)
+  - [Environment File](#environment-file)
+  - [Pull-and-Run Deployment](#pull-and-run-deployment)
+  - [First-Time or Recovery Provisioning](#first-time-or-recovery-provisioning)
+  - [Health Verification](#health-verification)
+  - [Zero/Low-Downtime Update Pattern](#zerolow-downtime-update-pattern)
+  - [Rollback](#rollback)
+  - [Operational Tasks](#operational-tasks)
+    - [View logs](#view-logs)
+    - [Restart one service](#restart-one-service)
+    - [Stop stack](#stop-stack)
+    - [Keep volumes (recommended) vs remove volumes (destructive)](#keep-volumes-recommended-vs-remove-volumes-destructive)
+  - [Nginx and Proxy Considerations](#nginx-and-proxy-considerations)
+  - [Security Baseline](#security-baseline)
+  - [Common Deployment Pitfalls](#common-deployment-pitfalls)
+  - [Troubleshooting](#troubleshooting)
+
 ## Environments
 
 Linear Void runs in two separate environments:
@@ -9,7 +37,7 @@ Linear Void runs in two separate environments:
 | **Test Lab**   | `192.168.88.40` (internal) | `tcp://192.168.88.40:2375` | Integration testing, staging, CI/CD validation |
 | **Production** | Hetzner VPS (TBD)          | `tcp://<hetzner-ip>:2375`  | Public linearvoid.tv serving real viewers      |
 
-**Current state (2026-08-06):** Test lab is active and receives automated CD deploys. Production Hetzner VPS is **not yet provisioned**. The CD workflow (`cd.yml`) and `docker-compose.prod.yml` currently target the test lab. Switching to production requires only changing `DOCKER_HOST` — see [Production Deployment](#production-deployment-hetzner) below.
+**Current state (2026-08-06):** Test lab is active and receives automated CD deploys. Production Hetzner VPS is **not yet provisioned**. The CD workflow (`cd.yml`) and `docker-compose.prod.yml` currently target the test lab. Switching to production requires only changing `DOCKER_HOST` — see [Production Deployment](#production-target-hetzner) below.
 
 ## Production Target (Hetzner)
 
@@ -28,7 +56,7 @@ Linear Void runs in two separate environments:
 
 ### Cutover Plan
 
-1. Provision Hetzner VPS (see `TODO.md` #92)
+1. Provision Hetzner VPS (see [Production Deployment](#production-target-hetzner) section)
 2. Add production secrets to Gitea (`CI_PROD_*` prefix)
 3. Update `DOCKER_HOST` in CD workflow to Hetzner public IP
 4. Trigger deploy → validate health checks
@@ -49,7 +77,17 @@ Linear Void runs in two separate environments:
 
 ### Pipeline Readiness
 
-The Gitea Actions CD workflow (`cd.yml`) already supports `DOCKER_HOST` as a configurable variable. To switch targets:
+Three Gitea Actions workflows drive the full pipeline:
+
+| Workflow      | Trigger          | Purpose                                                                                  |
+| ------------- | ---------------- | ---------------------------------------------------------------------------------------- |
+| `ci.yml`      | Push to `main`   | Lint, build frontend, vet Go, build & push Docker images (`:latest`, `:main`)            |
+| `cd.yml`      | Push to `main`   | Deploy to test lab (`192.168.88.40:2375`) — runs **in parallel** with CI                 |
+| `release.yml` | Tag push `*.*.*` | Build & push versioned Docker images (`:X.Y.Z`, `:X.Y`, `:latest`), create Gitea Release |
+
+CI and CD run simultaneously on every push to `main`. The deploy pulls whatever `:latest` images are available in the registry at that moment.
+
+The CD workflow (`cd.yml`) uses `DOCKER_HOST` to target the deployment host. To switch targets:
 
 ```bash
 # Test lab (current)
@@ -59,7 +97,7 @@ DOCKER_HOST=tcp://192.168.88.40:2375
 DOCKER_HOST=tcp://<hetzner-public-ip>:2375
 ```
 
-No code changes needed in the pipeline. See `TODO.md` #91 and #92–#99 for full production deployment checklist.
+No code changes needed in the pipeline. See `DEPLOYMENT.md` Production Deployment section for full checklist.
 
 ## Target Topology
 
@@ -99,7 +137,7 @@ See .env.example and SETUP.md for full variable reference.
 
 Images are built and pushed automatically by the CI and release workflows (see [CONTRIBUTING.md](CONTRIBUTING.md#versioning-and-releases) for the release procedure).
 
-Every push to `main` produces `:main` and `:latest` tags. Semantic version tags (`v*`) produce `:X.Y.Z`, `:X.Y`, and `:latest` tags.
+Every push to `main` triggers CI (builds `:main` and `:latest` tags) and CD (deploys `:latest` to test lab) in parallel. Semantic version tags (`*.*.*`, e.g. `1.0.9`) trigger the release workflow which builds `:X.Y.Z`, `:X.Y`, and `:latest` tags and creates a Gitea Release.
 
 From repository root: