feat: gated deploy with preview, audit log, rollback trail (stage 4)

- pulp_client: create_publication / update_distribution / wait_for_task
- GET /repos/{uuid}/deploy/confirm: 미리보기(현재→대상, 순 변화) + type-to-confirm 모달
- POST /repos/{uuid}/deploy: 검증 게이트(서버측 재확인) → publication 생성 →
  distribution 교체 → 감사 로그. 2단계 실패 시 '운영망 변경 여부' 명확화
- audit.record_deploy: 누가/언제/repo/이전버전→대상버전 JSONL (롤백 추적)
- 배포 버튼은 검증 통과 + 미배포 버전만 활성, 성공 시 버전목록 OOB 갱신
- 인증은 TODO (operator placeholder, 배포 비밀번호 재확인 예정)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/demo.py

@@ -121,7 +121,10 @@ class DemoPulpClient:
         # 저장소별 현재 배포 버전 (publication href 에 uuid-버전 인코딩)
         deployed = {"0001": 2, "0002": 1, "0003": 3, "0004": 1}
         return [
-            {"publication": f"/pulp/api/v3/publications/rpm/rpm/{u}-{v}/"}
+            {
+                "pulp_href": f"/pulp/api/v3/distributions/rpm/rpm/{u}/",
+                "publication": f"/pulp/api/v3/publications/rpm/rpm/{u}-{v}/",
+            }
             for u, v in deployed.items()
         ]
 
@@ -133,3 +136,18 @@ class DemoPulpClient:
                 f"/pulp/api/v3/repositories/rpm/rpm/{uuid}/versions/{number}/"
             )
         }
+
+    def create_publication(self, version_href: str) -> str:
+        return "/pulp/api/v3/tasks/demo-pub/"
+
+    def update_distribution(self, dist_href: str, publication_href: str) -> str:
+        return "/pulp/api/v3/tasks/demo-dist/"
+
+    def wait_for_task(self, task_href: str, attempts: int = 120, delay: float = 1.0):
+        # 데모: 즉시 완료. publication task 면 새 publication 리소스를 돌려준다.
+        created = (
+            ["/pulp/api/v3/publications/rpm/rpm/demo-new/"]
+            if "pub" in task_href
+            else []
+        )
+        return {"state": "completed", "created_resources": created}