deploy: remove two staging papercuts (preflight project + backend --no-traffic)

Both surfaced while running the v1.1-r2 staged deploy by hand.

1. scripts/deploy-preflight.sh read only $PROJECT (default placeholder), but the
   deploy scripts and .env.deploy.local set PROJECT_ID — so a deploy needed a
   separate `export PROJECT=...` or the preflight aborted "unsafe". Now PROJECT
   resolves from $PROJECT -> $PROJECT_ID -> PROJECT_ID in .env.deploy.local ->
   placeholder, so it just works (incl. a standalone run).

2. backend/deploy-gcp.sh had no staged option, so a code redeploy always went to
   100% immediately — unlike the frontend, which has DEPLOY_NO_TRAFFIC. Add the
   same DEPLOY_NO_TRAFFIC=1 -> `--no-traffic --tag ${DEPLOY_TAG:-stg}` knob,
   applied to BOTH image-only and full deploy modes, so a staged canary +
   explicit promote is one command (proctor-api serves the live exam).

Comments-only behaviour change is opt-in; default deploy paths are unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: karthikeyan5

backend/deploy-gcp.sh

@@ -230,11 +230,23 @@ COMMON_RUN_ARGS=(
   --timeout 120s
 )
 
+# Staged zero-downtime option (mirrors frontend/deploy-gcp.sh): DEPLOY_NO_TRAFFIC=1
+# deploys a NEW revision WITHOUT taking traffic, tagged for verification on its tag
+# URL; promote later with `gcloud run services update-traffic "$SERVICE_NAME"
+# --to-revisions=<rev>=100` (prior revision held at 0% for instant rollback).
+# Applies to BOTH deploy modes. proctor-api serves the LIVE exam, so a staged
+# canary + explicit promote is the safe path during/near a test. Unset = the new
+# healthy revision serves 100% immediately.
+TRAFFIC_ARGS=()
+if [ -n "${DEPLOY_NO_TRAFFIC:-}" ]; then
+  TRAFFIC_ARGS=(--no-traffic --tag "${DEPLOY_TAG:-stg}")
+fi
+
 if [ "$DEPLOY_MODE" = "image-only" ]; then
   # Routine code-only redeploy: ship the new image, PRESERVE existing env +
   # secrets (no --set-env-vars / --set-secrets, which would replace them).
   echo "==> image-only deploy: preserving the service's existing env + secret mounts."
-  gcloud run deploy "$SERVICE_NAME" "${COMMON_RUN_ARGS[@]}"
+  gcloud run deploy "$SERVICE_NAME" "${COMMON_RUN_ARGS[@]}" "${TRAFFIC_ARGS[@]}"
 else
   # FULL deploy: set the COMPLETE env map + mount the signer key, atomically.
   # NOTE: --set-env-vars REPLACES the whole env map and --set-secrets REPLACES
@@ -290,7 +302,8 @@ else
   echo "==> full deploy: setting the complete env + mounting the signer key (${SIGNER_SECRET_NAME})."
   gcloud run deploy "$SERVICE_NAME" "${COMMON_RUN_ARGS[@]}" \
     --set-env-vars="$ENV_VARS" \
-    --set-secrets="${SIGNER_MOUNT_PATH}=${SIGNER_SECRET_NAME}:latest"
+    --set-secrets="${SIGNER_MOUNT_PATH}=${SIGNER_SECRET_NAME}:latest" \
+    "${TRAFFIC_ARGS[@]}"
 fi
 
 echo "Backend URL:"

scripts/deploy-preflight.sh

@@ -23,14 +23,21 @@ set -euo pipefail
 cd "$(dirname "$0")/.."
 
 REGION="${REGION:-asia-south1}"
-PROJECT="${PROJECT:-your-gcp-project-id}"
 SLUG="${1:-}"
 GCLOUD="${GCLOUD:-$HOME/google-cloud-sdk/bin/gcloud}"
 
 if [ ! -f .env.deploy.local ]; then echo "✗ .env.deploy.local not found (need ADMIN_PASSWORD)"; exit 2; fi
 ADMINPW="$(grep -E '^ADMIN_PASSWORD=' .env.deploy.local | head -1 | cut -d= -f2- | sed -e 's/^"//' -e 's/"$//')"
 if [ -z "$ADMINPW" ]; then echo "✗ ADMIN_PASSWORD missing from .env.deploy.local"; exit 2; fi
 
+# Resolve the project from $PROJECT, then $PROJECT_ID (what the deploy scripts and
+# .env.deploy.local actually set), then PROJECT_ID read from .env.deploy.local, then
+# a placeholder. This removes the footgun of needing a separate `export PROJECT=...`
+# before a deploy — the frontend deploy invokes this preflight with PROJECT_ID set,
+# and a standalone run picks PROJECT_ID up straight from the deploy env file.
+ENV_PROJECT_ID="$(grep -E '^PROJECT_ID=' .env.deploy.local | head -1 | cut -d= -f2- | sed -e 's/^"//' -e 's/"$//')"
+PROJECT="${PROJECT:-${PROJECT_ID:-${ENV_PROJECT_ID:-your-gcp-project-id}}}"
+
 API_URL="$("$GCLOUD" run services describe proctor-api --region "$REGION" --project "$PROJECT" --format='value(status.url)' 2>/dev/null || true)"
 if [ -z "$API_URL" ]; then echo "✗ could not resolve proctor-api URL (gcloud auth?)"; exit 2; fi