server/deploy.sh: build here, back up, migrate, switch, verify

Production ran code from 31 August and answered 404 to most of the API
the merchant and mobile clients are written against. The script builds
the web app into a static linux binary on the developer machine (the
host has 3.6 GB shared with other services and must not compile), backs
the database up, runs the migrations with the new binary while the old
server still serves so a failure stops with nothing changed, switches,
and proves the routes over the public URL. API.md now names the API host
correctly: mcp.loyaly.ai, not the console's platform.loyaly.ai.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGcjxF1cNLcuwc3DAPcnfj

API.md

@@ -1,6 +1,6 @@
 # Behavision API — for the web console, a mobile app, and platform administration
 
-Base URL: `https://platform.loyaly.ai` (locally `http://127.0.0.1:8088`).
+Base URL: `https://mcp.loyaly.ai` — the API host. (`platform.loyaly.ai` serves the head-office web console, not the API.)
 Everything is JSON unless stated. All times are RFC 3339 UTC unless a field says
 otherwise. Every shape below is taken from the server's own types, not written
 from memory — if the two ever disagree, the server is right and this file has a