feat: AI판정/OCR/알림톡/소셜로그인/푸시/CODEF 전체 구현 + CI SSH 전환

Backend (server/src):
- services/anthropic.ts — Claude API 래퍼 (키 없으면 룰베이스 fallback)
- services/ocr.ts — Naver Clova + Google Vision 듀얼 연동 + 영수증 필드 파서
- services/solapi.ts — 카카오 알림톡 HMAC 서명 + 드라이런
- services/expoPush.ts — Expo Push API 전송
- services/codef.ts — 보험 통합조회 mock + 실연동 포인트
- routes/ai.ts, ocr.ts, devices.ts, social.ts (naver/apple), alimtalk.ts, codef.ts
- Prisma: PushDevice 모델 + binaryTargets linux-musl-openssl-3.0.x
- Dockerfile: apk add openssl (Prisma schema engine 정상화)
- api-secrets에 9개 외부 API 키 슬롯 추가 (optional)

Frontend:
- api/endpoints.ts: aiApi, ocrApi, deviceApi, socialApi, codefApi
- services/kakao.ts — Kakao JS SDK 동적 로드 + Auth.login
- services/push.ts — expo-notifications 권한/토큰 등록 + 서버 전송
- LoginScreen — 카카오/네이버/애플 버튼 (웹은 토큰 입력 fallback)
- AIJudgeScreen — 실제 /ai/claim-judge 호출, source(llm/rules) 표시
- ClaimScreen — 영수증 촬영 시 자동 OCR → 병원/날짜/제목 자동 기입
- useAuthStore hydrate 시 푸시 토큰 등록

Infra:
- eas.json (development/preview/production 빌드 프로필)
- API_KEYS.md — 9개 외부 서비스 발급/등록 가이드
- scripts/deploy-remote.sh 개선 (sudo 정확히, traefik cp 버그 수정, API fail 시 로그 출력)
- deploy/k8s/api.yaml — 외부 API 키 환경변수 매핑 (optional=true)

CI/CD:
- .gitea/workflows/deploy.yml → SSH 기반으로 전환
  (appleboy/ssh-action으로 서버 접속 → deploy-remote.sh 실행)
- 필요 Secrets: SSH_HOST, SSH_USER, SSH_PASSWORD

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/k8s/api.yaml

@@ -58,6 +58,26 @@ spec:
                 secretKeyRef:
                   name: api-secrets
                   key: databaseUrl
+            - name: ANTHROPIC_API_KEY
+              valueFrom: { secretKeyRef: { name: api-secrets, key: anthropicApiKey, optional: true } }
+            - name: CLOVA_OCR_URL
+              valueFrom: { secretKeyRef: { name: api-secrets, key: clovaOcrUrl, optional: true } }
+            - name: CLOVA_OCR_SECRET
+              valueFrom: { secretKeyRef: { name: api-secrets, key: clovaOcrSecret, optional: true } }
+            - name: GCP_VISION_API_KEY
+              valueFrom: { secretKeyRef: { name: api-secrets, key: gcpVisionApiKey, optional: true } }
+            - name: SOLAPI_API_KEY
+              valueFrom: { secretKeyRef: { name: api-secrets, key: solapiApiKey, optional: true } }
+            - name: SOLAPI_API_SECRET
+              valueFrom: { secretKeyRef: { name: api-secrets, key: solapiApiSecret, optional: true } }
+            - name: SOLAPI_PFID
+              valueFrom: { secretKeyRef: { name: api-secrets, key: solapiPfId, optional: true } }
+            - name: SOLAPI_SENDER_KEY
+              valueFrom: { secretKeyRef: { name: api-secrets, key: solapiSenderKey, optional: true } }
+            - name: CODEF_CLIENT_ID
+              valueFrom: { secretKeyRef: { name: api-secrets, key: codefClientId, optional: true } }
+            - name: CODEF_CLIENT_SECRET
+              valueFrom: { secretKeyRef: { name: api-secrets, key: codefClientSecret, optional: true } }
           readinessProbe:
             httpGet:
               path: /health