feat: add systemd, nginx and Caddy deployment configs

Serve src/ directly from the web server with no Node process involved. The
Caddyfile is the shortest path to TLS, which every non-localhost deployment
needs: on a plain-HTTP LAN address Chromium drops WebCodecs and blocks
IndexedDB, so export slows to real-time capture and projects stop saving.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/nginx.conf

@@ -0,0 +1,47 @@
+# Serves src/ directly. Drop into /etc/nginx/sites-available/motionity and
+# point ssl_certificate at your own files.
+#
+# TLS is not decoration here: WebCodecs (the fast exporter) and IndexedDB
+# (project saving) are secure-context only, so the app loses both when reached
+# over plain http:// on anything other than localhost.
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name motionity.example.com;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name motionity.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/motionity.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/motionity.example.com/privkey.pem;
+
+    root /opt/motionity/src;
+    index index.html;
+
+    # The audio and video panels seek, which needs byte ranges (on by default).
+    # Large media should not be buffered through gzip.
+    gzip on;
+    gzip_types text/css text/javascript application/javascript application/json image/svg+xml;
+    gzip_min_length 1024;
+
+    add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy no-referrer always;
+
+    location = /index.html {
+        add_header Cache-Control "no-cache" always;
+    }
+
+    location ~* \.(js|css|svg|png|jpe?g|gif|webp|woff2?|mp3|wav|mp4|webm)$ {
+        add_header Cache-Control "public, max-age=604800" always;
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}