chore(security): MED cluster — Coolify URL scrub + isCurrent device-id + SLEEP_DURATION migration note

- Coolify runbook + audit briefs scrub the live deploy URL to a
  placeholder (Sec-MED-2). Real values live in repo secrets.
- /api/auth/me/devices isCurrent now compares against the session's
  device id, not the unauthenticated X-Device-Id header (Sr-MED-5).
- Migration 0036 sleep-duration unit shift documented + verification
  command added to the coolify-auto-deploy howto.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/audit/v1415-auto-deploy.md

@@ -117,7 +117,8 @@ auto-deploy code ships:
    Token format: `n_<base62>`.
 2. **Add two GitHub repository secrets**:
    - `COOLIFY_WEBHOOK` =
-     `https://apps-01.bombeck.io/api/v1/deploy?uuid=pg8wggwogo8c4gc4ks0kk4ss&force=false`
+     `https://<COOLIFY_INSTANCE>/api/v1/deploy?uuid=<APPLICATION_UUID>&force=false`
+     (the actual values live in repo secrets only).
    - `COOLIFY_TOKEN` = the token from step 1.
 3. **Configure Coolify outgoing notifications**:
    - Settings → Notifications → Webhook