fix: restore and lock production PDF uploads

[ShenzheZhu]

Closes #1008

Summary

• documents the signer credential as an object read/write/delete identity in production Compose
• adds a deploy-time GCS create/delete smoke using the running backend credential
• fails deployment immediately when production bucket permissions cannot support PDF uploads

Incident remediation

The production bucket now grants roles/storage.objectUser to humanly-pdf-signer@hai-gcp-representation.iam.gserviceaccount.com. A live write/delete probe using GCS_KEY_FILENAME passed after the IAM repair.

Verification

• bash -n scripts/deploy.sh
• git diff --check
• POSTGRES_PASSWORD=test BACKEND_IMAGE=humanly-backend:test FRONTEND_USER_IMAGE=humanly-frontend-user:test FRONTEND_IMAGE=humanly-frontend:test INFERENCE_IMAGE=humanly-inference:test docker compose -f docker-compose.prod.yml config --quiet
• production signer credential: GCS write/delete smoke passed

Scope

No application data model or UI behavior changes.