feat: Unraid deploy, dealer-flow heatmap, confluence zones, 13F capture

Ship Node production images, Unraid compose, and Gitea CI/CD (test then
push registry images; cron script if no runner). Rebuild dealer flow as a
heatmap-first map with integrity gates and chart helpers. Add confluence
zone rules, session clock, capture evidence, and tighter 13F/queue/options
paths, plus the matching UI and tests.

deploy/unraid/user-scripts/sync-and-up.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# Unraid User Scripts → "Run in background" on a 5–15 min cron.
+# Pulls main from Gitea and rebuilds the stack when HEAD moved.
+#
+# First-time:
+#   mkdir -p /mnt/cache/appdata/investor-flow
+#   git clone http://unraid.local:3003/transnet/investor-flow.git \
+#     /mnt/cache/appdata/investor-flow/repo
+#   cp /mnt/cache/appdata/investor-flow/repo/deploy/unraid/.env.example \
+#     /mnt/cache/appdata/investor-flow/.env
+#   # edit .env
+# Then point this script at those paths (or set the env vars below).
+
+set -euo pipefail
+
+REPO_DIR="${IFLOW_REPO_DIR:-/mnt/cache/appdata/investor-flow/repo}"
+ENV_FILE="${IFLOW_ENV_FILE:-/mnt/cache/appdata/investor-flow/.env}"
+COMPOSE="docker compose --project-directory ${REPO_DIR} --env-file ${ENV_FILE}"
+LOG_TAG="investor-flow-cd"
+
+log() { echo "[${LOG_TAG}] $*"; }
+
+if [[ ! -d "${REPO_DIR}/.git" ]]; then
+  log "ERROR: ${REPO_DIR} is not a git checkout"
+  exit 1
+fi
+if [[ ! -f "${ENV_FILE}" ]]; then
+  log "ERROR: missing ${ENV_FILE}"
+  exit 1
+fi
+
+cd "${REPO_DIR}"
+git fetch --prune origin main
+LOCAL=$(git rev-parse HEAD)
+REMOTE=$(git rev-parse origin/main)
+
+if [[ "${LOCAL}" == "${REMOTE}" ]]; then
+  log "already at ${LOCAL:0:12} — no deploy"
+  # still ensure the stack is up
+  ${COMPOSE} up -d --remove-orphans
+  exit 0
+fi
+
+log "updating ${LOCAL:0:12} → ${REMOTE:0:12}"
+git merge --ff-only origin/main
+${COMPOSE} up -d --build --remove-orphans
+
+# Wait for health
+for i in 1 2 3 4 5 6 7 8 9 10; do
+  if curl -fsS "http://127.0.0.1:${IFLOW_WEB_PORT:-3000}/health" >/dev/null \
+    && curl -fsS "http://127.0.0.1:${IFLOW_BACKEND_PORT:-3001}/health" >/dev/null; then
+    log "healthy after deploy"
+    exit 0
+  fi
+  sleep 3
+done
+
+log "WARNING: containers started but health checks did not pass in 30s"
+${COMPOSE} ps
+exit 1