Deploy jobs use GitHub environments

[byteful]

What changed

The admin deploy job now runs inside the GitHub staging / production environment. A production deploy waits for approval by a release reviewer and can only run from main or a release tag. No admin UI changes.

Before you start

• Where: GitHub → civfix-admin → Actions, right after this merges to main; then admin.civfix.dev
• Sign in as: operator (through Cloudflare Access)
• Related PRs: Deploy jobs use GitHub environments civfix-app#63, https://github.com/civfix/dev-env/pull/22 (and the backend environment PR)

Verify

[Admin]

1. Open the "Deploy (Cloudflare Pages)" run started by the merge — Expect: the job shows the environment "staging", starts without waiting, and finishes green.
2. Open admin.civfix.dev and sign in — Expect: the dashboard loads as before.
3. In Actions, open "Deploy (Cloudflare Pages)" → "Run workflow", pick any branch other than main, run it — Expect: the job is refused before any step runs, with a message that the branch is not allowed to deploy to "staging".

Regression

Production release — [Admin]

1. At the next release, open the release run of "Deploy (Cloudflare Pages)" — Expect: it shows "Waiting" for review in "production"; after approval it deploys admin.civfix.org.

Not covered

• The production approval itself until the next release.
• Release tags cut before this merge have no environment in their workflow and are not gated (secrets stay repo-level by decision).