OIC remote runtime: deploy on a single always-on host #233

Context

Investigations must keep running and resume without a developer's laptop being online. Builds on #168 (shared remote host for the UI).

Behavior to implement

• A deployment guide and config for one always-on host (for example EC2): the API and UI server, the worker, the agent runtime, and its own configured MCP servers and tools.
• Two separate credential domains: agent provider keys, and source or tool credentials. Both come from a secret manager and are never written to disk in plain text or into checkpoints.
• Durable database with backups (Postgres here). The host's local disk is never the only copy of anything.
• Starts on boot, has a health endpoint, and recovers jobs after a restart (OIC durable job worker: retries, idempotent commits, restart recovery #226).

Acceptance criteria

• Replace the host from a backup and confirm that investigations, checkpoints, and claims are intact.
• Restarting the host mid-investigation resumes or retries it according to policy.