deploy: pull prebuilt images instead of building on the event server

The production compose still carried `build:` keys and no `image:` keys, so a
`git clone` onto the CX22 followed by `docker compose up -d` would have started a
fat-LTO release build of 427 crates on a 2-vCPU/4 GB box — the outcome the whole
build-on-the-Mac decision exists to avoid, reached silently because `pull` skips a
service it is told to build rather than failing.

Both services now pull `registry.mc02.dev/eventsnap/*:${EVENTSNAP_VERSION}` with the
`:?` form, so a missing tag fails the command instead of resolving to an empty one.
`docker-compose.build.yml` restores the `build:` keys for the workstation that
produces the images, from the same context paths.

Also here:

- `DOMAIN` gets the same `:?` guard. Blank did not fail — it produced `https://` for
  the frontend's ORIGIN and collapsed the Caddyfile's site block into a malformed
  global block, so the stack came up with no TLS and no site.
- `stop_grace_period: 20s` on the app. Docker's default stop timeout is 10s, exactly
  the app's own drain budget, so a redeploy could SIGKILL the process at the moment it
  was finishing — truncating the in-flight upload the graceful shutdown protects.
- `COMMENTS_ENABLED` is pinned "false" alongside MEDIA_PATH. It is a product decision
  for this event, and `.env.example` ships the generic `true`; pinning it means an
  operator who copies the example and edits only the secrets cannot ship comments on.
- The frontend runtime stage now copies the lockfile and uses `npm ci`. Without it the
  three `^`-ranged deps re-resolved at build time, so an image rebuilt days later could
  differ from the one that was tested. Image also drops 120 MB -> 65 MB.
- `docker-compose.dev.yml` told the operator that production had the same `$`-eating
  bug and to escape the hash as `$$` in `.env`. That is wrong and it breaks a working
  deployment: Compose uses single-quoted env_file values literally, and doubling
  produces a 74-character string `looks_bcrypt` rejects. Verified with `printenv`.

The runbook's rollback pointed at `v0.12.0`, which has 6 migrations against HEAD's 22
and was never built or pushed — running the emergency card's rollback line would have
crash-looped the app with `VersionMissing` during the event. §9 now has you tag one
build twice so the rollback target is bit-identical, and says plainly what that can and
cannot fix. Every `$DOMAIN` command gained the `set -a; . ./.env` it needs, the
down-migration psql commands are wrapped in `sh -c` so the container expands the
credentials rather than sending `-U ""`, and the advice to lower `max_video_size_mb`
is withdrawn: the client guard it was premised on does exist, but is pinned to a
compile-time constant, so lowering the DB value only moves failures later.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.dev.yml

@@ -21,11 +21,15 @@ services:
       # app user can't create it from `/`, so every upload 500s with EACCES. The media
       # volume is mounted at /media (see docker-compose.yml) — point the app there.
       MEDIA_PATH: /media
-      # Recent Docker Compose interpolates env_file values, so the `$` segments of the
-      # bcrypt ADMIN_PASSWORD_HASH in .env get eaten (the salt reads as an unset var) —
-      # every admin login then 401s. Re-supply it here with `$` doubled to `$$` so Compose
-      # passes the literal hash. NOTE: production (docker-compose.yml + .env) has the SAME
-      # bug — escape the hash as `$$` in .env, or set it via `environment:` there too.
+      # Set here purely so local dev needs no `.env` at all. The `$` are doubled because
+      # THIS is a `docker-compose.yml` `environment:` value, where Compose does interpolate.
+      #
+      # DO NOT COPY THE DOUBLING INTO `.env`. An earlier version of this comment claimed
+      # production had "the same bug" and told you to escape the hash as `$$` there — that is
+      # wrong and it breaks a working deployment. Compose uses SINGLE-QUOTED `env_file` values
+      # literally, which is the form `.env.example` ships, so the `$` segments survive intact;
+      # doubling them produces a 74-character string that `looks_bcrypt` rejects and the app
+      # refuses to boot on. Verified with `docker compose exec app printenv`.
       ADMIN_PASSWORD_HASH: "$$2b$$12$$PAteqCNpsbm6d0HTJcywfOaUovjAU.iNVlsL7EDYaRC/z4P/xv7ye"
       # Smoke-testing the comment kill-switch: boot-time flag, so it needs a restart
       # (not an admin-UI toggle). Backend rejects new comments (403) and the frontend
@@ -33,9 +37,10 @@ services:
       COMMENTS_ENABLED: "false"
 
   caddy:
-    # The prod caddy service has no env_file, so the Caddyfile's `{$DOMAIN}` expands
-    # to empty and the site block collapses into a malformed global block. Supply it
-    # for local dev (from .env → localhost, which Caddy serves with a local self-signed
-    # cert). NOTE: the prod compose likely needs DOMAIN wired to caddy too.
+    # The caddy service has no env_file, so the Caddyfile's `{$DOMAIN}` would expand to empty
+    # and the site block would collapse into a malformed global block. Supply it for local dev
+    # (from .env → localhost, which Caddy serves with a local self-signed cert). Production
+    # already wires DOMAIN into caddy's `environment:`, guarded with `:?` so an unset value
+    # fails the command instead of silently producing a site with no address.
     environment:
       DOMAIN: ${DOMAIN}