Production deploy for musicshare.binarygnome.com

- docker-compose.prod.yml overlay: Caddy with automatic HTTPS on one
  origin (web at /, API at /api incl. websocket), internal-only Postgres/
  Redis/API/web, secure cookies, private-network servers blocked, nightly
  pg_dump backups kept 14 days
- deploy/export-db.sh and import-db.sh to carry a database to the server
  (same TOKEN_ENCRYPTION_KEY required for stored connections)
- Base compose no longer requires apps/api/.env
- README: deployment, Spotify via scrobblers, SMTP settings

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

deploy/production.env.example

@@ -0,0 +1,28 @@
+# Copy to deploy/production.env on the server and fill in. Never commit the real file.
+
+DOMAIN=musicshare.binarygnome.com
+
+# Generate each with: openssl rand -base64 32
+POSTGRES_PASSWORD=
+TOKEN_ENCRYPTION_KEY=
+
+# Optional: exact "Open in Spotify" links (catalog search only; no user sign-in)
+SPOTIFY_CLIENT_ID=
+SPOTIFY_CLIENT_SECRET=
+LASTFM_API_KEY=
+LASTFM_SHARED_SECRET=
+ODESLI_API_KEY=
+PLEX_CLIENT_ID=musicshare
+APPLE_TEAM_ID=
+APPLE_MUSICKIT_KEY_ID=
+APPLE_MUSICKIT_PRIVATE_KEY=
+
+# Optional donation link shown on the website
+DONATION_URL=
+
+# Outgoing email (verification, password reset). SMTPS on 465.
+SMTP_HOST=
+SMTP_PORT=465
+SMTP_USER=
+SMTP_PASSWORD=
+MAIL_FROM=musicshare <app@musicshare.binarygnome.com>