feat(#30): Gate B [10/10]: Deploy compose + WOO_BASE_URL (OPS-1, GC-5)

- deploy/.env.example: placeholders only (no real URLs, proper comments)
- frontend/Dockerfile: Node 20 stub server for compose build
- deploy/tests/test-compose-health.sh: OPS-1 compose health smoke test
- deploy/tests/test-woo-base-url.sh: GC-4/5/FUND-25 validation suite
- backend/app/api/settings.py: PUT rejects woo_base_url (422), consumer keys (422),
  text() wrapping for SQLAlchemy 2.x, key primary key fix
- backend/tests/contract/test_woo_base_url.py: 8 contract tests for GC-4/GC-5

Tests: 39/39 backend tests pass (8 new, 31 existing green)
Deploy: 5/5 shell tests pass (Docker unavailable for compose-up path)

deploy/.env.example

@@ -1,11 +1,16 @@
-# Placeholders only. Copy to deploy/.env (chmod 600). Never commit real values.
-# Generate SLAB_AES_KEY: openssl rand -base64 32
+# SlabUploader deploy environment — placeholders only.
+# Copy to deploy/.env and fill real values. Do not commit real values.
+# chmod 600 deploy/.env
 
-SLAB_AES_KEY=
-APP_HOSTNAME=slab.example.local
+# AES-GCM master key: 32 bytes base64. Generated via: openssl rand -base64 32
+SLAB_AES_KEY=CHANGE_ME_32_BYTE_BASE64_KEY
+
+# WooCommerce store URL (HTTPS only). Deploy-time SoT, not editable in app.
+WOO_BASE_URL=https://your-store.example.com
+
+# Hostname for Caddy TLS (LAN/Tailscale). Used in Caddyfile.fragment.
+APP_HOSTNAME=slab.local
+
+# Bind ports (loopback only — Caddy is the TLS edge).
 FRONTEND_PORT=18080
 FASTAPI_PORT=18081
-
-# Plan of record: Woo store URL. HTTPS only. Not editable in Settings.
-# Server must reject http:// at startup.
-WOO_BASE_URL=https://www.whidbeywoodstore.com