feat(deploy): deploy a release by hand from Gitea Actions

A deploy workflow, started only by hand (or through the API) and only
from master, pulls the chosen image (release tag, sha or latest) and
runs that image's own update.sh against VM103's compose directory
through the Docker socket. update.sh now copies the database through the
running server first, installs the image's compose.yaml and update.sh
with --install, and restores the previous compose file together with
the previous image when the new version does not come up. CI also
builds release tags v*.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -6,6 +6,8 @@ data
 docs
 tools
 deploy
+!deploy/compose.yaml
+!deploy/update.sh
 .env
 .env.*
 *.log