feat: SSH key rotation guide + .env.app preflight check

[heznpc]

Summary

Two small polish items deferred from the last review pass.

• SSH key rotation guide (docs/VPS_DEPLOY.md): new section covering quarterly rotation cadence, zero-downtime two-key window, GitHub Secret update, and the recovery path via VPS provider console if you lock yourself out.
• .env.app preflight (cd.yml): a new SSH step that runs before docker compose up -d --wait. It fails the workflow with a clear doc pointer if ~/.env.app is missing or unreadable, and warns (does not fail) when the file is world-readable.
• Section 5 update: now explicitly documents that ~/.env.app must pre-exist and that chmod 600 is the recommended permission.

The preflight lives in cd.yml rather than scripts/deploy-with-rollback.sh because the shared script is also used by the CI rollback integration test (which runs without an env file on the runner) — keeping env-file assumptions in the production-only workflow preserves that symmetry.

Test plan

• CI rollback integration test still passes (unchanged script, env check lives outside).
• YAML lint / workflow syntax passes.
• Docs render correctly on GitHub.