Add CRM stub flag, deploy/backup scripts, CI and prod runbook

- CRM_USE_STUB: local runs no longer reach the live CRM. With only the
  Checkbox stub, a stub receipt would still move the real order to PACKED.
  Refused in production, same as CHECKBOX_USE_STUB.
- scripts/deploy.sh: backup, fast-forward main, build, health check and
  code rollback on failure. scripts/backup.sh: pg_dump with verification
  and 14-day rotation (used by cron and deploy.sh).
- Gitea Actions CI: ruff + pytest, oxlint + build.
- DEPLOY.md runbook; CLAUDE.md rules for safe local development.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/app/api/deps.py

@@ -10,13 +10,11 @@ from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.config import settings
 from app.core.security import TokenError, decode_access_token
 from app.db.models.user import User, UserRole
 from app.db.session import get_session
 from app.services.checkbox.client import CheckboxClient, get_checkbox_client
-from app.services.crm.client import CrmClient
-from app.services.crm.exo_client import ExoCrmClient
+from app.services.crm.client import CrmClient, get_crm_client
 from app.services.task_queue import TaskQueue, get_task_queue
 
 bearer_scheme = HTTPBearer(auto_error=False)
@@ -92,10 +90,6 @@ AdminUser = Annotated[User, Depends(require_admin)]
 CashierUser = Annotated[User, Depends(require_cashier)]
 
 
-def get_crm_client() -> CrmClient:
-    return ExoCrmClient(settings)
-
-
 CrmClientDep = Annotated[CrmClient, Depends(get_crm_client)]