feat: Unraid deploy, dealer-flow heatmap, confluence zones, 13F capture

Ship Node production images, Unraid compose, and Gitea CI/CD (test then
push registry images; cron script if no runner). Rebuild dealer flow as a
heatmap-first map with integrity gates and chart helpers. Add confluence
zone rules, session clock, capture evidence, and tighter 13F/queue/options
paths, plus the matching UI and tests.

.env.example

@@ -1,9 +1,17 @@
 # Investor Flow — Environment Variables
 # Copy this file to .env and fill in the values.
+# Unraid production: start from deploy/unraid/.env.example instead.
 
 # ─── Security ───────────────────────────────────────────────────────────────
 # Session secret for JWT signing (generate with: openssl rand -hex 32)
 IFLOW_SESSION_SECRET=dev-secret-change-me
+# AES-256-GCM key for x_credentials (64 hex chars). Required in production if
+# you migrate an existing DB. openssl rand -hex 32
+IFLOW_CRYPTO_KEY=
+
+# SQLite file inside the backend container / local checkout
+IFLOW_DB_PATH=
+IFLOW_DATA_DIR=./app/server/data
 
 # ─── SEC EDGAR ──────────────────────────────────────────────────────────────
 # Operator email for EDGAR user-agent (required by SEC fair-use policy)