build: per-environment Grav config override (prod Twig prod-mode)

Prod needs twig.cache:true / debug:false / auto_reload:false, but those
values break local dev, so they must not live in the committed
system.yaml. Add a per-environment override deployed only to the server
via Grav's environment://config (user/env/<host>/config/system.yaml):

- deploy/env/prod/system.yaml — version-controlled source of truth.
- make remote-apply-env-prod — writes it to the server + clears cache;
  resolves the host in-recipe (WEB_HOST || REMOTE_HOST) to avoid the
  recursive-make empty-export trap.
- remote-diag now shows the deployed override + whether twig cache is
  populating, so prod-mode can be verified not assumed.
- CLAUDE.md §1 rewritten: never flip committed system.yaml; use the
  override. Backlog updated (twig prod-mode + /post login-gate done;
  note stale .env.prod GRAV_VERSION and pending git-sync).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU

CLAUDE.md

@@ -171,15 +171,37 @@ Active settings in `user/config/system.yaml`:
 
 With these settings, Grav rebuilds templates on every request. This is intentionally slower but means you never need to flush cache after editing a `.html.twig` file.
 
-### Production mode (not yet configured)
+### Production mode (per-environment override)
 
-Before going live, change in `user/config/system.yaml`:
+Production needs different Twig settings than dev, but **never change the
+committed `user/config/system.yaml`** — `twig.cache: false` (and `debug`/
+`auto_reload: true`) are the *intended dev values*, and committing prod values
+there breaks local development for everyone.
 
-| Setting | Prod value | Why |
-|---|---|---|
-| `twig.cache` | `true` | Templates compiled once and reused; safe because theme files don't change at runtime |
+Instead, prod values are a **per-environment override** deployed to the server
+only, via Grav's per-environment config (`environment://config`, keyed on the
+request hostname):
 
-**Pre-launch smoke test required:** with `twig.cache: true`, submit one post via `/post` and confirm the entry appears in the trip page feed at `/trips/italy-2026-demo` immediately. This verifies the cache-on-save plugin (BUG-001 fix) works correctly with caching enabled.
+| Setting | Dev (committed) | Prod (override) | Why prod differs |
+|---|---|---|---|
+| `twig.cache` | `false` | `true` | Compile templates once and reuse |
+| `twig.debug` | `true` | `false` | No debug functions in prod |
+| `twig.auto_reload` | `true` | `false` | Don't stat templates every request |
+
+- **Source of truth:** `deploy/env/prod/system.yaml` (version-controlled).
+- **Deploy:** `make remote-apply-env-prod` — writes it to
+  `<webroot>/user/env/<hostname>/config/system.yaml` and clears cache. It
+  deep-merges over the committed `system.yaml`.
+- **Not synced by content:** `user/env/` is outside the content repo's tracked
+  folders, so `content-push` / git-sync / `remote-fetch-content` do **not**
+  restore it. **Re-run `make remote-apply-env-prod` after any fresh install.**
+- The hostname segment defaults to `REMOTE_HOST`; override with `WEB_HOST` in
+  `.env.<env>` if Grav sees a different host than the SSH host.
+
+**Pre-launch smoke test required:** with the prod override applied, submit one
+post via `/post` and confirm the entry appears in the trip page feed
+immediately. This verifies the cache-on-save plugin (BUG-001 fix) works
+correctly with caching enabled.
 
 ### What the cache-on-save plugin handles