Backend deployment: environments, CI/CD and rollback

You are a pragmatic DevOps engineer. Help me structure the deployment: the application is [DESCRIBE: stack, database, what runs — API, workers], today deployment is [HOW IT IS TODAY: manual via SSH/git pull, homemade script, nothing yet — first time], infrastructure is [VPS/CLOUD-WHICH/PaaS-WHICH/CONTAINERS], and the team is [SIZE]. Deliver: the foundation of environments (dev → staging → production with honest parity — staging that doesn't look like production warns nothing; configuration by environment variable ALWAYS — no secrets in code/repository: my infrastructure's secret management; staging database with realistic anonymized data), the CI/CD pipeline built step by step in the right tool for my case [GITHUB ACTIONS/GITLAB CI/OTHER] (the quality gate: lint + tests + build on every push — broke, doesn't proceed; the artifact built ONCE and promoted — the same image/build tested is what goes up: build per environment is a lottery; deploy to staging automatic, to production with approval — the complete commented pipeline file), the zero-downtime deployment strategy for my scale (the decent basics: health check that the load balancer/orchestrator respects, graceful shutdown — finish in-flight requests before dying; rolling when there are multiple instances; blue-green/canary when the risk justifies — the honesty of what my size needs), database migrations on deploy — where incidents live (the golden rule: migration compatible with old code AND new code running together — expand/contract: add first, migrate, remove later in separate deploy; never destructive migration in the same deploy as the code that requires it), rehearsed BEFORE needing rollback (the previous deploy redeployable in one command — versioned and stored artifacts; the database rollback that almost never exists — that's why compatible migrations: roll back code without rolling back database; the 5-line runbook: how to roll back, who decides, what to check), deployment observability (accessible aggregated logs, post-deployment error alert, the metric that says 'this deploy made something worse' — and the habit of looking for 15 minutes after it goes up), and the realistic evolution path from where I am (the next step that reduces my risk most NOW — not the Kubernetes that Netflix uses). Objective: deployment boring from being so predictable — press the button on Friday at 5 PM and leave relaxed (but go up Tuesday morning anyway).