deploy: pull prebuilt registry images in compose (IMAGE_TAG)

Point the `app` and `bot` services at the images published to the Gitea
registry by the build-images workflow, so deploys pull instead of building:

  image: gitea.whitlocktech.com/uom/website-app:${IMAGE_TAG:-latest}
  image: gitea.whitlocktech.com/uom/website-bot:${IMAGE_TAG:-latest}

`build:` is kept, so `up --build` still works locally; the server runs
`docker compose pull && up -d`. IMAGE_TAG defaults to `latest` for routine
deploys and pins to an immutable `sha-<7>` build for reproducible deploys /
rollback — no per-deploy compose edits. Documented in .env.example + README.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114TpmrNW4wNXsHq5CR72jQ

docker-compose.yml

@@ -21,6 +21,13 @@ services:
     #   - "3306:3306"
 
   app:
+    # Pull the prebuilt image from the Gitea registry (published by
+    # .gitea/workflows/build-images.yml on every merge to main). `build:` is kept
+    # so a local `docker compose build`/`up --build` still works; on the server,
+    # `docker compose pull && up -d` uses the registry image and never builds.
+    # IMAGE_TAG defaults to `latest`; pin a specific build for reproducible
+    # deploys / rollback, e.g. IMAGE_TAG=sha-042a151 (see .env / .env.example).
+    image: gitea.whitlocktech.com/uom/website-app:${IMAGE_TAG:-latest}
     build: .
     restart: unless-stopped
     env_file: .env
@@ -44,6 +51,8 @@ services:
       - "3000:3000"
 
   bot:
+    # Same as app: pull the prebuilt bot image; IMAGE_TAG pins the build.
+    image: gitea.whitlocktech.com/uom/website-bot:${IMAGE_TAG:-latest}
     build:
       context: .
       dockerfile: bot/Dockerfile