feat: production deployment - full update with providers, admin, glossaries, pricing, tests

Major changes across backend, frontend, infrastructure:
- Provider system with model selection (Google, DeepL, OpenAI, Ollama, Google Cloud)
- Admin panel: user management, pricing, settings
- Glossary system with CSV import/export
- Subscription and tier quota management
- Security hardening (rate limiting, API key auth, path traversal fixes)
- Docker compose for dev, prod, and IONOS deployment
- Alembic migrations for new tables
- Frontend: dashboard, pricing page, landing page, i18n (en/fr)
- Test suite and verification scripts

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

README.md

@@ -171,6 +171,10 @@ List currently tracked files.
 
 ### Environment Variables (.env)
 
+1. **Copy** `.env.example` to `.env`: `cp .env.example .env`
+2. **Fill** required variables (see comments in `.env.example`: Required vs Optional).
+3. In **production** (`ENV=production`), missing required vars (e.g. `JWT_SECRET_KEY`, `ADMIN_USERNAME`, `ADMIN_PASSWORD` or `ADMIN_PASSWORD_HASH`, `ADMIN_TOKEN_SECRET`, `DATABASE_URL`, and `REDIS_URL` if rate limiting is on) cause the app to **fail at startup** with a clear message listing them (Story 6.6, NFR10).
+
 ```env
 # ============== Translation Services ==============
 TRANSLATION_SERVICE=google
@@ -200,7 +204,9 @@ INPUT_FILE_TTL_MINUTES=30
 OUTPUT_FILE_TTL_MINUTES=120
 
 # ============== Security ==============
+# When behind Nginx (production), HSTS is set by the proxy; ENABLE_HSTS applies when running the app without a reverse proxy (e.g. dev).
 ENABLE_HSTS=false
+# Use "*" only for local development; set explicit origins in production (see .env.example).
 CORS_ORIGINS=*
 
 # ============== Admin Authentication ==============
@@ -352,23 +358,24 @@ Add to your VS Code `settings.json` or `.vscode/mcp.json`:
 ### Security Checklist
 - [ ] Change `ADMIN_PASSWORD` or set `ADMIN_PASSWORD_HASH`
 - [ ] Set `CORS_ORIGINS` to your frontend domain
-- [ ] Enable `ENABLE_HSTS=true` if using HTTPS
+- [ ] Enable `ENABLE_HSTS=true` if using HTTPS (when not behind Nginx; behind Nginx, HSTS is set by the proxy)
 - [ ] Configure rate limits appropriately
 - [ ] Set up log rotation for `logs/` directory
 - [ ] Use a reverse proxy (nginx/traefik) for HTTPS
 
-### Docker Deployment (Coming Soon)
+### Docker Deployment
 
-```dockerfile
-FROM python:3.11-slim
-WORKDIR /app
-COPY requirements.txt .
-RUN pip install -r requirements.txt
-COPY . .
-EXPOSE 8000
-CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
+En production, utilisez le stack Docker Compose avec Nginx en reverse proxy (ports 80/443) :
+
+```bash
+# Avec certificats SSL dans docker/nginx/ssl/ (voir DEPLOYMENT_GUIDE.md)
+docker compose up -d
 ```
 
+- **Nginx** : terminaison TLS, HTTP→HTTPS, HSTS, routage `/api/*` → backend, `/*` → frontend (Story 6.5).
+- Backend et frontend ne sont pas exposés sur l’hôte ; tout passe par le proxy.
+- Détails : [DEPLOYMENT_GUIDE.md](./DEPLOYMENT_GUIDE.md) (SSL/TLS, santé `/health`, variables d’environnement).
+
 ## 📝 License
 
 MIT License