Run natively under systemd; Docker was unworkable in this LXC

Docker in this unprivileged Proxmox LXC was broken two independent ways:
AppArmor could not load the docker-default profile, so the daemon could
not start any new container, and runc could not set the
net.ipv4.ip_unprivileged_port_start sysctl, which is why every service
needed network_mode: host. `docker build` was impossible outright since
Docker 29 removed the classic builder. The stack only survived because
the containers predated the breakage - a reboot would have left the app
down, and nothing could be redeployed.

Postgres, MinIO and the app now run natively under systemd. Deploys
build out-of-place into releases/<sha> and swap a symlink, so the build
happens while the old release keeps serving and downtime is the ~3s
restart rather than the ~3min build. Rollback is the same swap in
reverse with no rebuild.

Dockerfile and docker-compose.prod.yml are unchanged and still work on
a normal host; the compose app service gains `build: .` so it can come
up on a VPS that cannot reach the LAN-only Gitea registry.

Documents three traps found during the migration: rewrites() in
next.config.mjs is evaluated at build time so MINIO_ENDPOINT changes
silently do nothing, prisma migrate deploy would fail because
production has no _prisma_migrations table, and the image proxy relies
on the bucket's anonymous-download policy.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

install.sh

@@ -2,7 +2,13 @@
 set -euo pipefail
 
 # ─────────────────────────────────────────────────────────────
-# DrinkTracker — Production Install Script
+# DrinkTracker — Production Install Script (Docker)
+#
+# For a fresh Docker-based install on a normal host or VPS.
+#
+# NOTE: the production LXC (192.168.2.169) no longer uses this — it runs the app
+# natively under systemd because Docker can't work in an unprivileged LXC. To
+# deploy there, use ./deploy/deploy.sh. See deploy/README.md.
 # ─────────────────────────────────────────────────────────────
 
 # Colors