feat: gated deploy with preview, audit log, rollback trail (stage 4)

- pulp_client: create_publication / update_distribution / wait_for_task
- GET /repos/{uuid}/deploy/confirm: 미리보기(현재→대상, 순 변화) + type-to-confirm 모달
- POST /repos/{uuid}/deploy: 검증 게이트(서버측 재확인) → publication 생성 →
  distribution 교체 → 감사 로그. 2단계 실패 시 '운영망 변경 여부' 명확화
- audit.record_deploy: 누가/언제/repo/이전버전→대상버전 JSONL (롤백 추적)
- 배포 버튼은 검증 통과 + 미배포 버전만 활성, 성공 시 버전목록 OOB 갱신
- 인증은 TODO (operator placeholder, 배포 비밀번호 재확인 예정)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/main.py

@@ -15,7 +15,7 @@ from fastapi.staticfiles import StaticFiles
 # 테스트 호환을 위해 re-export (tests 가 app.main.get_pulp_client 를 override 함)
 from .deps import get_pulp_client, templates
 from .pulp_client import PulpClient
-from .routes import dashboard, sync, versions
+from .routes import dashboard, deploy, sync, versions
 
 BASE_DIR = Path(__file__).resolve().parent
 
@@ -24,6 +24,7 @@ app.mount("/static", StaticFiles(directory=str(BASE_DIR / "static")), name="stat
 app.include_router(dashboard.router)
 app.include_router(sync.router)
 app.include_router(versions.router)
+app.include_router(deploy.router)
 
 __all__ = ["app", "get_pulp_client"]