feat: add persistent staging environment synchronization

[m-altaifi]

Summary

Closes #440.

Adds persistent staging environment synchronization between separate production and staging instances.

• Adds a secure staging receiver protected by environment configuration and a constant-time validated bearer token.
• Adds Settings → Staging for configuring, testing, refreshing, and disconnecting a staging target.
• Supports full content-database refreshes or replacement of selected tables while preserving unrelated staging data.
• Optionally synchronizes the site structure and settings, then republishes the staging site.
• Encrypts stored synchronization credentials and protects sensitive operations with capabilities, step-up authentication, and audit logging.
• Adds PostgreSQL and SQLite migrations, deployment configuration, documentation, and focused tests.

Staging infrastructure remains independent: the staging instance uses its own database, uploads volume, secret key, and public subdomain. Uploaded media is not copied during refresh.

Verification

• bun run build
• bun test — 120 relevant tests pass; the complete suite is blocked on Windows by existing SQLite EBUSY teardown and path-separator failures unrelated to this change.
• bun run lint
• Docker/deployment check — Compose configuration and deployment documentation were updated, but a live two-instance deployment was not run locally.

Checklist

• Tests cover behavior changes.
• Docs were updated when behavior, config, deployment, or public surfaces changed.
• No compatibility shim was added for old pre-release behavior.
• No secrets, local databases, uploads, or generated artifacts are included.

[m-altaifi]

@DavidBabinec