chore(deploy): mark deploy_prod.sh as deprecated; point at k3s flow

Production migrated from Docker Swarm to k3s on 2026-04-24, but
deploy_prod.sh continued to target the old hetzner1 Swarm manager.
Without dockerd running there it spent 30+ seconds doing SSH probes
before dying on a confusing "Got: false" Swarm-state error.

Add an early guard that fails immediately with a pointer to
deploy-k3s/scripts/03-deploy.sh and the kubeconfig-fetch one-liner.
ALLOW_LEGACY_SWARM_DEPLOY=1 still bypasses if anyone needs the old path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/scripts/deploy_prod.sh

@@ -1,6 +1,31 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# DEPRECATED — production migrated from Docker Swarm to k3s on 2026-04-24.
+# This script targets the old Swarm manager + registry flow and will fail
+# at the SSH/Swarm validation step because hetzner1 no longer runs dockerd.
+#
+# Use the k3s deploy stack instead:
+#
+#   export KUBECONFIG="$(pwd)/deploy-k3s/kubeconfig"
+#   ./deploy-k3s/scripts/03-deploy.sh
+#
+# If you don't have deploy-k3s/kubeconfig locally, fetch it once:
+#   ssh -i ~/.ssh/hetzner deploy@hetzner1 'sudo cat /etc/rancher/k3s/k3s.yaml' \
+#     | sed 's|server: https://127.0.0.1:6443|server: https://178.104.247.152:6443|' \
+#     > deploy-k3s/kubeconfig
+#   chmod 600 deploy-k3s/kubeconfig
+#
+# To override and run anyway (do NOT do this casually), set:
+#   ALLOW_LEGACY_SWARM_DEPLOY=1 ./deploy/scripts/deploy_prod.sh
+if [[ "${ALLOW_LEGACY_SWARM_DEPLOY:-0}" != "1" ]]; then
+  printf '[deploy][error] %s\n' \
+    "deploy_prod.sh is the legacy Docker Swarm flow. Production now runs on k3s." \
+    "Use ./deploy-k3s/scripts/03-deploy.sh instead (see top of this script for setup)." \
+    "If you really need the old Swarm path, set ALLOW_LEGACY_SWARM_DEPLOY=1." >&2
+  exit 1
+fi
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 DEPLOY_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 REPO_DIR="$(cd "${DEPLOY_DIR}/.." && pwd)"