ci(monorepo): share app validation and publish only through releases

[gustmrg]

What changed

• New reusable validate.yml (workflow_call, input app). It holds the build/test/lint steps for backend, MCP server and frontend.
  • main-validation.yml now calls it for each changed app: 92 → ~60 lines, same path filters.
  • release.yml calls it instead of repeating the steps. prepare now only resolves the version and checks the tag. release waits for validate.
• Publishing only through releases
  • Removed the push: tags triggers from the three publish workflows. A tag pushed by hand no longer deploys without going through the version bump and validation.
  • The publish workflows take only version and always check out the <app>/v<version> tag. The ref input is gone.
  • workflow_dispatch is kept on backend and MCP, and added to the frontend, to republish an existing release (e.g. rollback).
• Frontend rollback: if the version's release directory already exists on the server, the deploy reuses it and only switches the current symlink instead of failing. Releases remain immutable: existing files are never replaced.
• Names: "Backend/MCP Server/Frontend Release" → "... Publish", so they are not confused with the new Release entry point.
• CONTRIBUTING: updated the Releases section (republish/rollback instead of tag push).
• Docs: new docs/deployment.md describing the release flow, what each publish workflow deploys, rollback (including the caveat that backend migrations are not reverted) and the required secrets/server setup. It is linked from the root README and CONTRIBUTING. The frontend README pointed to a docs/deployment.md that was removed with the frontend-v2 migration; it now points to the new doc.

Why

Follow-up to #14. The publish workflows still had a tag trigger that bypassed the release flow, and the validation steps were duplicated between main-validation.yml and release.yml.

How it was verified

• actionlint passes on all workflows.
• This PR changes validate.yml, so its own Main Validation run exercises the reusable workflow for all three apps.
• The release and publish changes were not exercised end to end. The next release of any app will be the first run.

Risks / follow-up

• Change from ci(monorepo): add release workflow with automatic version bump #14: the release now validates the commit being released rather than the bumped tree. Only the version string differs, and it does not affect build or tests.
• Check names in Main Validation change (e.g. backend / backend). main has no required status checks, so nothing breaks.
• Changing a publish workflow no longer triggers app validation in PRs. Those files only affect deploys.