ci(web): codify the Vercel deployment

[SarthakWade]

Summary

• add an application-local apps/web/vercel.json aligned with the Vercel project's apps/web root
• document the production, preview, monorepo source, domain, security-header, verification, and rollback contracts
• lint deployment config, canonical URL, and security-header ownership to prevent dashboard and repository drift
• ignore local Vercel state and environment secret files without hiding checked-in environment examples
• retain headless-web-pi.vercel.app as canonical until LockInTime publishes a verifiably controlled custom domain

Validation

• Vercel Git-source preview built successfully from head commit 0eb2093
• pnpm dlx prettier --check AGENTS.md apps/web/vercel.json apps/web/scripts/validate-deployment-config.mjs docs/DEPLOYMENT.md
• pnpm --filter @headless/web lint
• pnpm --filter @headless/web build
• pnpm test
• pnpm test:runtime
• pnpm audit --prod reports no known vulnerabilities

Deployment verification

Vercel project sssg5s-projects/headless-web is connected to LockInTime/headless with production branch main, Root Directory apps/web, and source files outside the root directory enabled for the site's checked-in documentation inputs.

Preview: https://headless-le7zbj7k4-sssg5s-projects.vercel.app

The preview was built from head commit 0eb2093f4199ad21d68a8f0b9f9fcbd04e00ae0c. The homepage, /docs, /robots.txt, and /sitemap.xml return HTTP 200. Responses include the configured CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers. GitHub records the preview as a successful deployment for the same commit.

Closes #47

[yashranaway]

Review found and fixed two deployment issues: the custom pnpm install override could select Vercel’s oldest pnpm runtime even though this repo requires pnpm 9+, and the development command did not pass Vercel’s required $PORT. The branch now relies on lockfile-based pnpm detection, validates that contract, passes $PORT, combines both web policy validators from main, and passes web lint/build locally. The remaining blocker is account-level: this head SHA still needs a Vercel preview deployment before the draft is ready to merge.