refactor(config): use base.ini + secrets.ini → production.ini

- Dockerfile bakes config as /etc/ckan/base.ini
- Entrypoint merges base.ini + secrets.ini → /etc/ckan/production.ini
- Allows subPath mounts for secrets without overwriting base config

After deploy, apply subPath mount patch (see commit message).

Author: cooper667

deploy/Dockerfile.prod

@@ -81,7 +81,7 @@ RUN ln -s /usr/lib/adx /usr/lib/ckan
 
 # Copy entrypoint and config files
 COPY deploy/ckan-entrypoint-prod.sh /ckan-entrypoint.sh
-COPY deploy/production.ini $CKAN_CONFIG/production.ini
+COPY deploy/production.ini $CKAN_CONFIG/base.ini
 COPY ckan/adx_who.ini $CKAN_CONFIG/who.ini
 COPY ckan/ckan_supervisor.conf /etc/supervisor/conf.d/ckan_supervisor.conf
 COPY deploy/uwsgi.ini /usr/lib/adx/uwsgi.ini

deploy/ckan-entrypoint-prod.sh

@@ -12,21 +12,20 @@ export CKAN_VENV=$CKAN_HOME/venv
 export PATH=${CKAN_VENV}/bin:${PATH}
 
 # Combine base config with secrets using Python ConfigParser
-# secrets.ini values override production.ini
+# secrets.ini values override base.ini
 echo "Combining configuration files..."
 python3 << 'PYEOF'
 import configparser
-import sys
 
 config = configparser.ConfigParser()
-config.read('/etc/ckan/production.ini')
+config.read('/etc/ckan/base.ini')
 config.read('/etc/ckan/secrets.ini')  # Later values override earlier
 
-with open('/tmp/ckan.ini', 'w') as f:
+with open('/etc/ckan/production.ini', 'w') as f:
     config.write(f)
 PYEOF
-export CONFIG="/tmp/ckan.ini"
-export CKAN_INI="/tmp/ckan.ini"
+export CONFIG="/etc/ckan/production.ini"
+export CKAN_INI="/etc/ckan/production.ini"
 
 abort () {
   echo "$@" >&2