feat: add deploy-final.sh — complete single-command Hetzner install + deploy

[Copilot]

The existing setup-server.sh bootstraps a fresh server but has no git-based update path. The problem statement script was incomplete (Nginx config truncated), referenced a non-existent frontend/ dir instead of client/, and contained several security issues.

New script: UNICORN_FINAL/scripts/deploy-final.sh

Functional fixes over problem statement original

• frontend/ → client/ (actual React app directory in UNICORN_FINAL)
• Complete Nginx config: HTTP→HTTPS redirect, SSE (/stream) with proxy_buffering off, WebSocket Upgrade header, gzip
• Git step handles three cases: full git repo on server, CI-rsync'd content (no .git), first install (shallow-clones repo and copies UNICORN_FINAL/ only)
• PM2 clean start (delete all → start ecosystem.config.js) to avoid "Process N not found" errors on crashed processes

Security hardening

• eval echo ~$SUDO_USER → getent passwd "$RUN_USER" to eliminate command injection via SUDO_USER
• Guards openssl presence and validates non-empty output before writing secrets to .env
• Hardcoded BTC wallet / owner info moved to env-var overrides (BTC_WALLET_ADDRESS, OWNER_NAME, OWNER_EMAIL)

Other

• Node version check uses numeric >= 20 comparison instead of grep "^v20\." to avoid downgrading Node 21+
• certbot renewal: uses certbot.timer (systemd) when present, cron fallback only when the unit is absent
• All steps skippable via SKIP_SSL=1, SKIP_GIT=1, SKIP_FRONTEND=1