Exclude backend/certs from rsync deploy to preserve CA certs

The rsync --delete was wiping CA-signed certificates on every deploy.
Add backend/certs to the exclude list alongside .env and uploads so
certs installed on the target host are never overwritten by deploys.
The fallback cert generation step still runs if no cert exists (fresh
deploy), but will not replace an existing CA-signed cert.

.gitlab-ci.yml

@@ -178,6 +178,7 @@ deploy-staging:
         --exclude='*.log'
         --exclude='*.db'
         --exclude='.env'
+        --exclude='backend/certs'
         ./ ${STAGING_USER}@${STAGING_HOST}:${STAGING_DIR}/
     - rsync -az frontend/build/ ${STAGING_USER}@${STAGING_HOST}:${STAGING_DIR}/frontend/build/
     - ssh ${STAGING_USER}@${STAGING_HOST} "cd ${STAGING_DIR} && npm ci --prefer-offline"
@@ -223,6 +224,7 @@ deploy-production:
         --exclude='*.log'
         --exclude='*.db'
         --exclude='.env'
+        --exclude='backend/certs'
         --exclude='.compliance-staging'
         ./ ${PROD_USER}@${PROD_HOST}:${PROD_DIR}/
     - rsync -az frontend/build/ ${PROD_USER}@${PROD_HOST}:${PROD_DIR}/frontend/build/