Add AWS deployment tutorial (two-instance demo runbook)

[arvsa]

The Phase 5 tutorial deliverable from plan/argus-server-gaps-and-demo-deployment-v1.md, written as a top-to-bottom runbook for the recommended §4.2 topology:

• Step 0–4: names/vars, S3 bucket (private + SSE + 7-day lifecycle), two IAM roles/instance profiles (client = PutObject on its own zone prefix only; server = read-only), security groups + 2× t4g.small Ubuntu ARM EC2 via CLI, DNS.
• Step 5–6: Docker + swap + rsync + Traefik/Let's Encrypt on both boxes (using the repo's compose.traefik.yml).
• Step 7–8: full .env for each role, compose.yml --profile client vs plain, smoke checks (exporter pushes, aws s3 ls, ingestion logs, role-aware UI).
• Step 9: signing-key registration through the new zone-detail UI panel (public key read from a pushed manifest — private key never leaves the zone's volume).
• Step 10: the zone-went-dark staleness demo.
• Plus ongoing ops (update deploys, backups, key-volume caveat), a troubleshooting table, full teardown commands, and the graduation path.

Cross-linked from deployment.md, which stays the variable-by-variable reference. The doc is explicitly marked as authored ahead of the first real deployment — per the plan, it gets corrected in place while Phase 5 actually runs.

🤖 Generated with Claude Code