Add Render deploy step for server and nlp-service images

[WiderDeveloper]

Summary

• Picks Render ("Deploy an existing image") as the hosting target for both GHCR-published images — server (Express, :3000) and nlp-service (FastAPI, :8000). See docs/deployment.md for the full comparison against Fly.io, AWS ECS, and Vercel and why Render is the smallest fit given a private GHCR registry and no other infra requirements (no local DB — server.ts talks to an external Mujarrad backend + Gemini API).
• Adds deploy-server / deploy-nlp-service jobs to .github/workflows/docker-publish.yml. Each runs after its image publishes on push to main and POSTs to a Render deploy hook with imgURL pinned to the commit SHA that was just built — so the running service always matches the exact published commit, not a possibly-stale :latest.
• Both deploy jobs if:-gate on their secret being set (RENDER_DEPLOY_HOOK_SERVER / RENDER_DEPLOY_HOOK_NLP_SERVICE) and skip themselves otherwise, so merging this doesn't require the Render services to exist yet.

Not done here (needs a human with Render account access)

This repo's CI has no Render or GHCR-read credentials to provision resources with. docs/deployment.md has the full one-time setup checklist:

1. Add a GHCR registry credential in Render (PAT with read:packages).
2. Create the two Web Services from existing images (ports 3000 / 8000), with their real env vars (GEMINI_API_KEY, MUJARRAD_API_PUBLIC_KEY, MUJARRAD_API_SECRET_KEY, MUJARRAD_SPACE_SLUG) — those secret values live outside this repo.
3. Copy each service's deploy-hook URL into the two GitHub Actions secrets named above.

Until that's done, the new jobs no-op (green, not red) on every push to main.

Test plan

• YAML validated (python3 -c "import yaml; yaml.safe_load(...)")
• After secrets are added: confirm a push to main triggers both deploy jobs and Render shows a successful deploy of the new image tag

🤖 Generated with Claude Code