feat: Add initial deployment setup for OTSSignsOrchestrator

- Create index.html for the web application interface.
- Implement deploy.sh script for building and deploying the application to a Docker Swarm manager.
- Add docker-compose.yml for defining application and PostgreSQL service configurations.

.env.example

@@ -1,11 +1,47 @@
-# OTSSignsOrchestrator.Server — required environment variables
-# Copy to .env and fill in real values.
+# OTSSignsOrchestrator — environment variables
+# Copy to .env and fill in real values before running.
 
-ConnectionStrings__OrchestratorDb=Host=localhost;Port=5432;Database=orchestrator_dev;Username=ots;Password=devpassword
-Stripe__WebhookSecret=whsec_...
-Stripe__SecretKey=sk_test_...
+# ── PostgreSQL ───────────────────────────────────────────────────────────────
+# Used directly by the app. When running via docker-compose, POSTGRES_PASSWORD
+# is also required so the postgres service can initialise the database.
+ConnectionStrings__OrchestratorDb=Host=postgres;Port=5432;Database=orchestrator;Username=ots;Password=changeme
+POSTGRES_PASSWORD=changeme
+
+# ── JWT ──────────────────────────────────────────────────────────────────────
+# Key must be at least 32 characters (256-bit). Generate with:
+#   openssl rand -base64 32
 Jwt__Key=change-me-to-a-random-256-bit-key
+# Jwt__Issuer=OTSSignsOrchestrator   # optional — has a default
+# Jwt__Audience=OTSSignsOrchestrator # optional — has a default
+
+# ── Bitwarden Secrets Manager ────────────────────────────────────────────────
+# Machine account access token from https://vault.bitwarden.com
+Bitwarden__AccessToken=
+Bitwarden__OrganizationId=
+# ProjectId is the default project for orchestrator config secrets
+Bitwarden__ProjectId=
+# InstanceProjectId is optional; instance-level secrets go here when set
+# Bitwarden__InstanceProjectId=
+# Bitwarden__IdentityUrl=https://identity.bitwarden.com  # optional
+# Bitwarden__ApiUrl=https://api.bitwarden.com            # optional
+
+# ── Stripe ───────────────────────────────────────────────────────────────────
+Stripe__SecretKey=sk_test_...
+Stripe__WebhookSecret=whsec_...
+
+# ── Authentik (SAML IdP) ─────────────────────────────────────────────────────
 Authentik__BaseUrl=https://auth.example.com
 Authentik__ApiToken=
-SendGrid__ApiKey=SG....
-OTS_SIGNS_SERVER_URL=http://localhost:5000
+# UUID of the OTS signing certificate-key pair in Authentik
+Authentik__OtsSigningKpId=
+# Authentik__SourcePreAuthFlowSlug=default-source-pre-authentication  # optional
+# Authentik__SourceAuthFlowSlug=default-source-authentication         # optional
+
+# ── Email (SendGrid) ─────────────────────────────────────────────────────────
+Email__SendGridApiKey=SG....
+# Email__SenderEmail=noreply@otssigns.com  # optional
+# Email__SenderName=OTS Signs             # optional
+
+# ── Git template repository ───────────────────────────────────────────────────
+# These are stored in Bitwarden at runtime; set here only for local dev without BW.
+# Git__CacheDir=.template-cache  # optional