Infra: production branch promotion for app.caterium.ru

Prepare Caterium for Timeweb Cloud App Platform production hosting on app.caterium.ru with QA-gated promotion to the production branch.

.github/workflows/promote-production.yml

@@ -0,0 +1,45 @@
+name: Caterium Promote Production
+
+on:
+  workflow_run:
+    workflows: ["Caterium QA"]
+    types: [completed]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: caterium-production-promotion
+  cancel-in-progress: false
+
+jobs:
+  promote:
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success' &&
+          github.event.workflow_run.event == 'push' &&
+          github.event.workflow_run.head_branch == 'main' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout verified main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Verify promoted commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected="${{ github.event.workflow_run.head_sha }}"
+          actual="$(git rev-parse HEAD)"
+          if [ "$actual" != "$expected" ]; then
+            echo "Refusing promotion: main moved after the verified QA run."
+            echo "verified=$expected current=$actual"
+            exit 1
+          fi
+
+      - name: Promote to production branch
+        shell: bash
+        run: |
+          set -euo pipefail
+          git push origin HEAD:refs/heads/production

TIMEWEB-APP-PLATFORM.md

@@ -0,0 +1,27 @@
+# Caterium production on Timeweb Cloud App Platform
+
+Target domain: `app.caterium.ru`
+
+## Application settings
+- Repository: `pavlov346346-source/caterium-app`
+- Branch: `production`
+- Type: Frontend / HTML-CSS-JS
+- Publish directory: `public`
+- Auto deploy: enabled for the `production` branch
+
+The `production` branch is updated automatically only after the `Caterium QA` GitHub Actions workflow succeeds for a push to `main`.
+
+## Domain
+Add custom domain `app.caterium.ru` in Timeweb App Platform and use the DNS records Timeweb provides for the application. Keep Cloudflare proxy out of the production request path.
+
+## Validation after DNS/SSL is ready
+1. Open `https://app.caterium.ru` without VPN from a Russian network.
+2. Sign in to Caterium.
+3. Verify workspace loading and Supabase sync.
+4. Create and edit a test order.
+5. Open clients and catalog.
+6. Upload/view a photo.
+7. Generate/download a client proposal PDF.
+8. Install/open the PWA and verify refresh/offline shell.
+
+Do not decommission the old Cloudflare Worker until these checks pass.