Epic 4: Ship it - Docker, Jenkins, DNS cutover

Single-image pipeline modelled on issues (parameterised Jenkinsfile, confirm-tested gate, SHA tags, backup-on-deploy) and the direct apex cutover from Cloudflare Pages to the VPS. No staging environment - accepted risk, and Pages stays deletable as rollback until the flip is verified.

Done when jamesmddoyle.com serves from the VPS with a valid certificate and Pages is gone.