Rename project from KeepItTalking to DS Chat

Renames the app's display name everywhere (page titles, PWA manifest,
TopBar, email subject lines, HMAC signature header) and its internal
technical slug from chatapp to ds-chat/ds_chat: the Python package name
and console script, the systemd unit and its user/group/paths, the deploy
scripts, the Docker container names, and the Postgres database name.

The live dev Postgres role stays "chatapp" -- renaming a role requires
disconnecting the session using it, which needed a temporary superuser
role Claude's auto-mode classifier correctly declined to create
unsupervised. Functionally invisible (it's just a login credential), but
worth knowing about if this ever needs fully cleaning up by hand.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/ds-chat.env.example

@@ -0,0 +1,37 @@
+# /etc/ds-chat/env  (production)
+#
+# This file is loaded by systemd's EnvironmentFile= (see
+# deploy/systemd/ds-chat.service) directly into the app process's
+# environment -- it is NOT a dotenv file Python reads from a working
+# directory, and it must never be committed to the repository.
+#
+# Install:
+#   sudo mkdir -p /etc/ds-chat
+#   sudo cp deploy/ds-chat.env.example /etc/ds-chat/env
+#   sudo chown root:ds-chat /etc/ds-chat/env
+#   sudo chmod 0640 /etc/ds-chat/env
+#   # then edit in the real values below
+#
+# See ../DEPLOYMENT.md for how each value is generated.
+
+# Points at the data server's PRIVATE address -- never the public one.
+# The role/password here are whatever you created on the data server in
+# DEPLOYMENT.md step 2.
+DATABASE_URL=postgresql+asyncpg://ds_chat:REPLACE_ME@<DATA_SERVER_PRIVATE_IP>:5432/ds_chat
+
+# Generate with: python3 -c "import secrets; print(secrets.token_urlsafe(32))"
+SESSION_SECRET=REPLACE_ME
+
+# true in production -- cookies are only sent over HTTPS. The local dev
+# default (backend/.env.example) is false because dev runs over plain HTTP.
+SESSION_HTTPS_ONLY=true
+
+# Matches the requirepass set in /etc/redis/redis.conf on the data server
+# (see DEPLOYMENT.md step 2). Same private-address rule as DATABASE_URL.
+REDIS_URL=redis://:REPLACE_ME@<DATA_SERVER_PRIVATE_IP>:6379/0
+
+# Optional: push notifications are silently skipped if these are unset.
+# Generate with: .venv/bin/python -m app.cli generate-vapid-keys
+VAPID_PUBLIC_KEY=
+VAPID_PRIVATE_KEY=
+VAPID_SUBJECT=mailto:you@example.com