deploy: split build into docker-compose.dev.yml overlay

Make the base docker-compose.yml strictly production-shaped — image: only, no
build: — so a production host can only ever pull, never accidentally build
(compose gives build precedence for `up --build`/`build`, which mixed the two
modes). Local builds move to an explicit, non-auto-loaded overlay.

  Production:   docker compose pull && docker compose up -d
  Development:  docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d --build

Verified with `docker compose config`: base renders image-only (no build) for
both services; the dev overlay adds build back (app -> Dockerfile,
bot -> bot/Dockerfile). README quick-start updated to the two-file flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114TpmrNW4wNXsHq5CR72jQ

docker-compose.yml

@@ -21,14 +21,14 @@ services:
     #   - "3306:3306"
 
   app:
-    # Pull the prebuilt image from the Gitea registry (published by
-    # .gitea/workflows/build-images.yml on every merge to main). `build:` is kept
-    # so a local `docker compose build`/`up --build` still works; on the server,
-    # `docker compose pull && up -d` uses the registry image and never builds.
-    # IMAGE_TAG defaults to `latest`; pin a specific build for reproducible
-    # deploys / rollback, e.g. IMAGE_TAG=sha-042a151 (see .env / .env.example).
+    # Prebuilt image from the Gitea registry (published by
+    # .gitea/workflows/build-images.yml on every merge to main). This file is
+    # production-shaped — image only, NO build: — so a production host can only
+    # ever pull, never accidentally build. IMAGE_TAG defaults to `latest`; pin a
+    # specific build for a reproducible deploy / rollback, e.g.
+    # IMAGE_TAG=sha-042a151 (see .env / .env.example). To build locally instead,
+    # overlay docker-compose.dev.yml (see README).
     image: gitea.whitlocktech.com/uom/website-app:${IMAGE_TAG:-latest}
-    build: .
     restart: unless-stopped
     env_file: .env
     environment:
@@ -51,11 +51,9 @@ services:
       - "3000:3000"
 
   bot:
-    # Same as app: pull the prebuilt bot image; IMAGE_TAG pins the build.
+    # Same as app: prebuilt bot image, pulled in production. Build locally via
+    # docker-compose.dev.yml.
     image: gitea.whitlocktech.com/uom/website-bot:${IMAGE_TAG:-latest}
-    build:
-      context: .
-      dockerfile: bot/Dockerfile
     restart: unless-stopped
     env_file: .env
     environment: