docs: clarify standard ci cd model

DEPLOYMENT.md

@@ -7,6 +7,24 @@
 - GitHub Actions uploads the repository contents to the server over SSH
 - the server does not need GitHub access to deploy
 
+## Standard target model for later
+When this moves from an internal test setup to a more standard delivery model, the target should be:
+1. feature branch
+2. CI
+3. merge into `develop`
+4. staging deploy
+5. staging validation
+6. merge into `main`
+7. production deploy
+
+Recommended standards for that future state:
+- staging and production use separate hosts or clearly separated environments
+- staging and production use separate secrets
+- production deploys only from `main`
+- production runs with HTTPS and `DJANGO_DEBUG=0`
+- production deploys require environment protection or approval in GitHub
+- rollback is documented and tested
+
 This is intentional. For a private repository, server-side `git clone` adds unnecessary credential management.
 
 ## Branch strategy