feat: add tagged deployment rollback

docs/DEPLOYMENT.md

@@ -45,6 +45,31 @@ worker images share the same Node workspace image; the web image builds the Vue
 application and serves it through Nginx with SPA fallback and internal `/api`
 proxying.
 
+## Tagged Releases And Rollback
+
+Use an immutable release tag for every deployment. The production Compose file
+uses `IMAGE_TAG` to select matching API, worker, and web images. Deploy with:
+
+```sh
+RELEASE_TAG=2026-09-09-01 ./scripts/deploy-production.sh
+```
+
+The deploy script builds the three tagged images, starts healthy data services,
+applies migrations with the tagged API image, and then switches the application
+services. Keep the previous release tag and migration state with the deployment
+record.
+
+Rollback application images with:
+
+```sh
+RELEASE_TAG=2026-09-08-02 ./scripts/rollback-production.sh
+```
+
+Image rollback is safe only when the previous image understands the current
+database schema. If the release included an incompatible schema change, restore
+the matching PostgreSQL backup before starting the previous images. Always
+verify the API and web health checks after a rollback.
+
 ## Health Checks
 
 Production Compose waits for healthy PostgreSQL, Redis, and API services before