docs: update production deployment workflow and runbook

[Dereje1]

Motivation

• Replace materially outdated Elastic Beanstalk source-build instructions with the currently working manual prebuilt-image workflow.
• Make the authoritative deployment runbook explain local linux/amd64 Docker builds, local runtime testing, pushing a tested image to private ECR, and deploying via a minimal Dockerrun.aws.json bundle.
• Preserve and clarify the existing production architecture and runtime integrations while removing instructions that caused unreliable on-instance builds.

Description

• Rewrote DEPLOYMENT.md into a comprehensive manual runbook that documents: source-state verification, linux/amd64 docker buildx commands, local image testing, ECR login/tag/push/verify steps, Dockerrun.aws.json template, minimal ZIP creation, application-version registration, EB update-environment deployment, macOS-compatible monitoring loops, verification checks, rollback, and troubleshooting for ECR-based deployments.
• Updated README.md Docker and Production Deployment sections to: show docker buildx targeting linux/amd64, a production docker run example, clarify that .env is runtime-only, and replace claims that EB builds the root Dockerfile with the new ECR + Dockerrun.aws.json flow.
• Added ECR prerequisite guidance, a least-privilege EC2-role policy template (with placeholders), and explicit rules for what must not be included in deployment bundles (source tree, Dockerfile, .env, node_modules, etc.).
• Documentation-only change that uses placeholders for all sensitive identifiers (<AWS_ACCOUNT_ID>, <AWS_REGION>, <ECR_REPOSITORY_URI>, <IMAGE_TAG>, <EB_APPLICATION_VERSION>, etc.) and preserves production domain, CloudFront, Route 53, MongoDB, S3, and OAuth references where still valid.

Testing

• Ran git diff --check and a targeted grep scan for stale or secret-containing patterns (searching for phrases like "Elastic Beanstalk will build the Docker image", pinterest-clone-deploy.zip, account-number-style ECR URIs, ARNs, and access-key patterns), both checks passed against the modified files.
• Verified the working tree changes are limited to documentation files: DEPLOYMENT.md and README.md.
• Did not run npm run compileTS, npm run lint, npm test, npm run build_server, or npm run build_client because this is a documentation-only PR and no application or infra code was modified.
• No production secrets, account IDs, ARNs, or private URIs were added to the repository; placeholders were used throughout.

---

Codex Task

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.61%. Comparing base (61274ab) to head (287df42).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #63   +/-   ##
=======================================
  Coverage   98.61%   98.61%           
=======================================
  Files          50       50           
  Lines        1805     1805           
  Branches      312      312           
=======================================
  Hits         1780     1780           
  Misses         24       24           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.