docs(deploy): add backend/devops convention questions checklist

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy/QUESTIONS-FOR-BACKEND.md

@@ -0,0 +1,45 @@
+# Questions for the backend / devops owner (house conventions)
+
+Purpose: confirm HQ's deployment matches how the other apps on the company EC2 box are set
+up, so nothing is inconsistent. Each item notes what HQ currently does, in parentheses, so
+answers can be a quick "matches" / "change to X". Tick answers inline as you get them.
+
+## Runtime & Node
+1. How do the other Node/API apps run on this box — `docker run`, docker-compose, `pm2`, or `systemd`? *(HQ uses docker-compose.)*
+   - **A:**
+2. What Node version do the APIs use, and how do you get Node 20+ given the host is Node 16 with old glibc (2.26) — containerized, `nvm`, or something else? *(HQ runs Node 20 inside its container.)*
+   - **A:**
+
+## Database
+3. Do all apps connect to `accurate-postgres` as the `postgres` superuser, or do any have their own DB user/role? *(Checked: only `postgres` exists; HQ uses it, matching.)*
+   - **A:**
+4. Is port `5432` intentionally open to the public internet (`0.0.0.0`), or should it be restricted to specific IPs in the security group?
+   - **A:**
+5. Are there backups of the shared Postgres — how and where?
+   - **A:**
+
+## Environment & secrets
+6. Where do apps keep their `.env` / secrets, and any convention for file location or permissions? *(HQ: `apps/hq/.env`, `chmod 600`.)*
+   - **A:**
+
+## nginx & TLS
+7. Do all vhosts go in `/etc/nginx/conf.d/*.conf`, and is there a filename convention? *(HQ: `sims.hq.conf`.)*
+   - **A:**
+8. For the APIs behind nginx, how do you pass the real client IP / handle `X-Forwarded-For` and `trust proxy`? *(HQ: nginx sets `X-Forwarded-For $remote_addr`; app uses `trust proxy 1`.)*
+   - **A:**
+9. How is the `*.simssoftware.in` wildcard cert renewed/managed (`/etc/ssl/sims/`)?
+   - **A:**
+
+## Networking & ports
+10. What port range do internal apps use, and do they bind to `127.0.0.1` or `0.0.0.0`? *(HQ binds `127.0.0.1:5182` — only nginx reaches it.)*
+    - **A:**
+
+## Deploy & operations
+11. How are updates deployed — WinSCP copy, `git pull`, or a pipeline? *(HQ: copied into `/usr/share/nginx/sims-hq`.)*
+    - **A:**
+12. What restarts containers/apps after a reboot — docker `restart` policy, `systemd`? *(HQ: `restart: unless-stopped`.)*
+    - **A:**
+
+## DNS
+13. Where is `simssoftware.in` DNS managed and who adds records? *(We added `hq` A -> 13.232.53.115.)*
+    - **A:**