fix(release): make deployment backup and rollback immutable

deploy/unraid/geointel.env.example

@@ -34,6 +34,8 @@ GEOINTEL_CORS_ORIGINS=https://geointel.itworx.tech,http://geointel.itworx.tech,h
 
 # Upload guard in MiB. The same 1-2048 limit is applied by nginx and FastAPI.
 GEOINTEL_MAX_UPLOAD_MB=500
+# Maximum decompressed vector payload processed fully in memory (1-256 MiB).
+GEOINTEL_MAX_IN_MEMORY_VECTOR_MB=64
 GEOINTEL_AOI_WORKER_ENABLED=true
 GEOINTEL_AOI_WORKER_POLL_SECONDS=2
 
@@ -46,6 +48,14 @@ GEOINTEL_AUTH_PASSWORD_HASH=
 GEOINTEL_AUTH_SESSION_SECRET=
 GEOINTEL_AUTH_SESSION_TTL_SECONDS=43200
 
+# Optional additive Authentik OIDC login. Configure all fields together. The
+# local operator credentials above remain the recovery login.
+GEOINTEL_PUBLIC_BASE_URL=http://localhost:1202
+GEOINTEL_AUTHENTIK_ISSUER=
+GEOINTEL_AUTHENTIK_CLIENT_ID=
+GEOINTEL_AUTHENTIK_CLIENT_SECRET=
+GEOINTEL_AUTHENTIK_ALLOWED_EMAIL=
+
 # Guest access is enabled by default whenever operator authentication is active.
 # It opens the seeded GeoIntel demo in a temporary, API-enforced restricted
 # session. Set this to false on installations containing private project data.
@@ -153,8 +163,9 @@ SPW_TERRAIN_ANALYSIS_RESOLUTION_M=5
 SPW_TERRAIN_MAX_SIDE_M=20000
 SPW_TERRAIN_MAX_PIXELS=12000000
 
-# Optional configured-YOLO runtime. Keep disabled unless a local model is mounted.
-GEOINTEL_INSTALL_AI=false
+# Production releases always contain the pinned AI dependencies. Inference may
+# remain disabled until an integrity-bound local model is mounted.
+GEOINTEL_INSTALL_AI=true
 YOLO_ENABLED=false
 YOLO_MODELS_DIR=/app/models
 YOLO_MODEL_PATH=