fix(ci): gate deploys on passing tags + fix markets feature flag test

- CI now creates v<pipeline_iid> tag after tests pass on master
- Supervisor fetches tags and only deploys when a newer tag is available;
  skips if already on latest or no tags exist
- Fix test_seeds_markets_enabled: markets is seeded disabled (enabled=0),
  test was asserting the wrong value

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -1,5 +1,6 @@
 stages:
   - test
+  - tag
 
 test:
   stage: test
@@ -14,6 +15,15 @@ test:
     - if: $CI_COMMIT_BRANCH == "master"
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
 
+tag:
+  stage: tag
+  image: alpine/git
+  script:
+    - git tag "v${CI_PIPELINE_IID}"
+    - git push "https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git" "v${CI_PIPELINE_IID}"
+  rules:
+    - if: $CI_COMMIT_BRANCH == "master"
+
 # Deployment is handled by the on-server supervisor (src/padelnomics/supervisor.py).
-# It polls git every 60s, detects code changes, and runs deploy.sh automatically.
+# It polls git every 60s, fetches tags, and deploys only when a new passing tag exists.
 # No CI secrets needed — zero SSH keys, zero deploy credentials.