Harden deploy README so a clean follow always works

[aperson30]

Why

Follows up on the deploy debugging session. Closes the remaining gaps that would let a literal step-by-step follow of the deploy section still break prod.

Changes (deploy section only)

1. Reinstall backend deps on every deploy. Step 2 rebuilt the frontend (npm ci) but nothing ran pip install -r requirements.txt. If a PR adds/bumps a Python dependency, restarting gunicorn with stale deps crashes on a missing import → empty site (the same failure class as the missing-module crash). Added the install alongside the frontend build, before the restart, so it happens while the old backend is still serving.
2. Guard git pull conflicts. If the server has local edits (this actually happened), git pull/checkout refuses. Added a note to git status + git checkout -- <file> rather than force past it.
3. Guard failed builds. Note to stop if npm run build errors, since nginx keeps serving the old dist until a build succeeds.

Test plan

• README-only, no code changes