[SandObserver]

Summary

• Add a docs-rebuild job to release.yml, running after release-page and calling a deploy hook so the documentation site rebuilds from the newly released tree.
• Expose prerelease as an output of release-page, and gate the new job on it so an rc tag never moves the site.
• Read the hook from a DOCS_DEPLOY_HOOK_URL secret, treat an absent secret as a no-op rather than a release failure, and check the response status without printing the URL.
• Document the secret and the Cloudflare deploy hook in docs/releasing.md.
• Extend the secrets-documentation test to cover secrets read outside release-prep.yml.

Testing
All green: backend tests with coverage at 94.23%, 877 frontend tests, lint, formatting, both typechecks, and the Docker build. Added 1 test asserting the job ordering, the empty permission set, the prerelease gate, the no-op on a missing secret, and that the hook URL is never printed.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.