Production deploy for musicshare.binarygnome.com

- docker-compose.prod.yml overlay: Caddy with automatic HTTPS on one
  origin (web at /, API at /api incl. websocket), internal-only Postgres/
  Redis/API/web, secure cookies, private-network servers blocked, nightly
  pg_dump backups kept 14 days
- deploy/export-db.sh and import-db.sh to carry a database to the server
  (same TOKEN_ENCRYPTION_KEY required for stored connections)
- Base compose no longer requires apps/api/.env
- README: deployment, Spotify via scrobblers, SMTP settings

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

docker-compose.yml

@@ -6,7 +6,10 @@ x-api: &api
     context: .
     dockerfile: apps/api/Dockerfile
   image: musicshare-api:local
-  env_file: apps/api/.env
+  # Local development config; on a server, docker-compose.prod.yml supplies deploy/production.env instead.
+  env_file:
+    - path: apps/api/.env
+      required: false
   environment:
     # Inside the compose network, services reach each other by name.
     DATABASE_URL: postgres://musicshare:musicshare@postgres:5432/musicshare