fix(deploy): production CRM deployment improvements

- Fix deploy_crm_only.sh: non-destructive hot reload
  - Enhanced stop logic with pgrep + fuser for port release
  - Added 3-layer verification (process/control/user)
  - Check /proc/$pid/exe for (deleted) marker
  - Never delete DB

- Fix portal script contracts: crm_session → crm_subject
  - deploy_tksea_portal.sh: use $cookie_crm_subject
  - test_tksea_portal_assets.sh: assert crm_subject exists
  - nginx.example.conf: updated trusted subject header

- Add systemd service management
  - sub2api-crm.service.template
  - install_crm_systemd.sh
  - verify_crm_deployment.sh

Update docs/plans/2026-06-04-next-version-plan.md with deployment findings.

scripts/deploy/.env.deploy.example

@@ -0,0 +1,13 @@
+# Copy this file to scripts/deploy/.env.deploy before running deploy_tksea_portal.sh
+# Do not commit real credentials.
+
+KEY=/path/to/ssh-key.pem
+REMOTE=ubuntu@example-host
+REMOTE_CRM_PORT=18190
+
+# Optional overrides
+# REMOTE_PORTAL_DIR=/var/www/sub2api-portal
+# REMOTE_NGINX_SITE=/etc/nginx/sites-available/tksea
+# REMOTE_HOST_PORT=8080
+# LOCAL_PORTAL_DIR=/absolute/path/to/deploy/tksea-portal
+# REMOTE_STAGE_DIR=/tmp/sub2api-portal-deploy