fix(ci): bouw met productie-.env, deploy met env+volumes en rollback

- Deploy kopieert de productie-.env van de host in de build-context:
  Next.js bakt NEXT_PUBLIC_* in en valideert DATABASE_URL/HOTEL_NAME
  (SKIP_ENV_VALIDATION is verboden voor productie, zie src/env.ts).
- Dockerfile builder installeert git (next.config.ts deploymentId).
- Deploy-container krijgt --env-file + dezelfde volumes als compose,
  stopt ook de oude compose-container (poort 3002) en rolt terug via
  compose bij een falende health check.

src/lib/deploy-workflow-contract.test.ts

@@ -39,6 +39,24 @@ describe("deploy job", () => {
 		expect(deployJob).toContain("--name epicnext-cms-app");
 	});
 
+	it("provides production .env to the build", () => {
+		expect(deployJob).toContain("cp /var/www/atom-nexst/.env .env");
+	});
+
+	it("runs container with production env and volumes", () => {
+		expect(deployJob).toContain("--env-file /var/www/atom-nexst/.env");
+		expect(deployJob).toContain("/var/www/Gamedata:/var/www/Gamedata");
+		expect(deployJob).toContain("/app/storage");
+	});
+
+	it("frees port 3002 by stopping the compose container", () => {
+		expect(deployJob).toContain("docker stop epicnext-cms 2>/dev/null || true");
+	});
+
+	it("rolls back to compose on health check failure", () => {
+		expect(deployJob).toContain("docker compose");
+	});
+
 	it("runs health check", () => {
 		expect(deployJob).toContain("/api/health");
 		expect(deployJob).toContain('"database":true');