Merge pull request #26 from jjbrunton/hotfix/admin-docker-context

fix(admin): restore admin docker build context, allow hotfix branches into main

.dockerignore

@@ -39,3 +39,11 @@ terraform
 .claude
 .codex
 .ralph
+
+# The admin app builds from this same monorepo context (apps/admin/Dockerfile).
+!apps/admin
+!apps/admin/**
+
+# Host build artefacts must never leak into any image context.
+**/node_modules
+**/dist

.github/workflows/verify.yml

@@ -24,9 +24,14 @@ jobs:
             echo "master is frozen; target staging or main" >&2
             exit 1
           fi
-          if [ "$BASE_BRANCH" = "main" ] && [ "$HEAD_BRANCH" != "staging" ]; then
-            echo "Only staging may be promoted to main" >&2
-            exit 1
+          if [ "$BASE_BRANCH" = "main" ]; then
+            case "$HEAD_BRANCH" in
+              staging|hotfix/*|release/*) ;;
+              *)
+                echo "main takes staging promotions, or a hotfix/* or release/* branch for direct work" >&2
+                exit 1
+                ;;
+            esac
           fi
           if [ "$BASE_BRANCH" != "staging" ] && [ "$BASE_BRANCH" != "main" ]; then
             echo "Feature pull requests target staging; promotions target main" >&2

docs/operations/backend-deployments.md

@@ -14,10 +14,14 @@ not deploy the retired Supabase data plane.
 | `master` | frozen legacy default | none | none |
 
 Normal feature pull requests target `staging`. After CI and authenticated staging
-acceptance pass, open a promotion pull request from `staging` to `main`. Do not
-add production-only commits to `main`: production should run the exact commit
-already exercised in staging. Direct pushes to either deployment branch are for
-explicit incident recovery only.
+acceptance pass, open a promotion pull request from `staging` to `main`. Prefer
+that route: production then runs the exact commit already exercised in staging.
+
+When production needs a change that cannot wait for the next promotion, open a
+pull request into `main` from a `hotfix/*` or `release/*` branch. CI enforces
+that naming so a direct-to-main change is always deliberate and visible. Land
+the same commit on `staging` too, or the next promotion will revert it. Direct
+pushes to either deployment branch remain blocked by branch protection.
 
 Each Dokploy Compose application is connected to `jjbrunton/Sauci`, watches its
 single branch with push-triggered automatic deployment, and uses