docs: make Timeweb production source of truth

README.md

@@ -3,23 +3,44 @@
 Caterium catering SaaS frontend with Supabase backend.
 
 ## Production
-Current Cloudflare Worker: `ancient-sound-04ab`
 
-Cloudflare publishes **only `public/`**. SQL, Edge Functions, tests and documentation are not web-accessible.
+Primary production URL: `https://app.caterium.ru`
+
+Production frontend is hosted on Timeweb Cloud App Platform:
+- repository: `pavlov346346-source/caterium-app`
+- branch: `production`
+- publish directory: `public`
+- auto deploy: enabled for `production`
+
+`main` is the integration branch. GitHub Actions runs the full Caterium QA workflow for each push to `main`. Only a successful QA run may promote the verified commit to `production`.
+
+The Cloudflare Worker `ancient-sound-04ab` is retained only as a fallback. It is not the primary production target and must not replace the Timeweb deployment unless an intentional fallback procedure is being used.
 
 ## Deploy checks
+
 ```bash
-npm install
+npm ci
+npm audit --audit-level=high
 npm run check:deploy
 npm run test:e2e
 ```
 
-## Cloudflare Git deployment
-- Build command: `npm run check:deploy`
-- Deploy command: `npx wrangler deploy`
-- Production branch: `main`
-- Root directory: `/`
+The QA workflow performs these checks automatically. High/critical npm audit findings block promotion.
+
+## Cloudflare fallback
+
+Use Cloudflare only as a backup deployment target. Manual fallback deployment is available as:
+
+```bash
+npm run deploy:cloudflare-backup
+```
+
+When configuring Git-based Cloudflare fallback deployment, use the verified `production` branch rather than `main` so the fallback receives the same QA-approved commit as Timeweb.
 
 ## Backend
+
 Supabase Edge Functions are versioned under `supabase/functions/`.
 SQL migration/history files live under `ops/sql/`.
+Database DDL changes should be applied as migrations and kept in repository history.
+
+See `TIMEWEB-APP-PLATFORM.md` for the production hosting checklist.