Add CRM stub flag, deploy/backup scripts, CI and prod runbook

- CRM_USE_STUB: local runs no longer reach the live CRM. With only the
  Checkbox stub, a stub receipt would still move the real order to PACKED.
  Refused in production, same as CHECKBOX_USE_STUB.
- scripts/deploy.sh: backup, fast-forward main, build, health check and
  code rollback on failure. scripts/backup.sh: pg_dump with verification
  and 14-day rotation (used by cron and deploy.sh).
- Gitea Actions CI: ruff + pytest, oxlint + build.
- DEPLOY.md runbook; CLAUDE.md rules for safe local development.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/backup.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Бэкап прод-БД lux_fiscal: cron пользователя deploy (ежедневно) и scripts/deploy.sh (перед выкладкой).
+# Дампы содержат зашифрованные ключи касс: для восстановления нужен тот же ENCRYPTION_KEY из .env.
+# Последняя строка вывода — "ok <путь к дампу> <размер>", её читает deploy.sh.
+set -eu
+
+PROJECT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+BACKUP_DIR="${BACKUP_DIR:-$HOME/backups/lux_fiscal}"
+KEEP_DAYS=14
+
+umask 077
+mkdir -p "$BACKUP_DIR"
+cd "$PROJECT_DIR"
+
+C="docker compose -f docker-compose.yml -f docker-compose.prod.yml"
+FILE="$BACKUP_DIR/lux_fiscal_$(date +%F_%H%M%S).dump"
+$C exec -T postgres sh -c 'pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" -Fc' > "$FILE.tmp"
+
+# Битый/пустой дамп не должен вытеснить ротацией хорошие.
+$C exec -T postgres pg_restore --list < "$FILE.tmp" > /dev/null
+mv "$FILE.tmp" "$FILE"
+
+find "$BACKUP_DIR" -name "lux_fiscal_*.dump" -mtime +"$KEEP_DAYS" -delete
+find "$BACKUP_DIR" -name "*.tmp" -mtime +1 -delete
+echo "$(date -Is) ok $FILE $(du -h "$FILE" | cut -f1)"