feat: deploy main to staging and tag reports with their environment

[devchaudhary24k]

Summary

Adds a staging deployment so merged changes can be tested before a release, and keeps staging traffic out of production analytics and error reports.

Deployments

• A merge into main publishes the main image and deploys the staging Dokploy application through the new DOKPLOY_STAGING_WEBHOOK_URL secret.
• A release (merging the Release Please PR) still publishes latest and the version tags and deploys production through DOKPLOY_WEBHOOK_URL.
• The single deploy job is split into deploy staging and deploy production, each skipped until its secret is set.

Environment tagging

• New optional runtime variable HEXLODE_ENVIRONMENT. Staging sets it to staging; when unset, the server reports production (or development locally).
• The server passes it to the browser with the other public settings.
• Sentry files every error, log and trace under that environment, in the browser and on the server, so alerts can be limited to production.
• PostHog adds an environment property to every event, next to app_version, so PostHog's test-account filter can hide staging and development from dashboards.

Docs

• DEPLOY.md: new "Staging and production" section, the Sentry alert and PostHog filter setup, and HEXLODE_ENVIRONMENT in the variable table.
• implementation.md and ADR 0005 describe the staging flow and the environment property.

Setup after merging

1. Dokploy staging app: image ghcr.io/pixelactstudio/hexlode:main, its own HTTPS domain, the same PostHog and Sentry variables as production, plus HEXLODE_ENVIRONMENT=staging.
2. PostHog: Project settings → Product analytics → Filter out internal and test users, add environment is not staging and environment is not development, and enable it on all new insights.
3. Sentry: set alert rules to the production environment.

Testing

• pnpm validate: Biome, types, 556 unit and browser tests, and the production build.
• Unit tests cover reading HEXLODE_ENVIRONMENT (including the production default and invalid values), passing it to Sentry, and registering it on PostHog events.
• Checked a built server: with HEXLODE_ENVIRONMENT=staging the page config reports staging, and without it reports production.
• actionlint passes on the workflows.

Merge note

dev had drifted from main because earlier PRs were squash-merged, which caused the conflicts here. main is now merged into dev with dev's content kept; that content already included everything on main.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}