deploy(compose): hardcode registry host, pull-only stack

Lock images to gitea.thewrightserver.net/josh/{vector-api,vector-web}
and drop the build: sections. docker compose up now only pulls; source
builds happen exclusively in CI.

docker-compose.yml

@@ -1,17 +1,16 @@
 # Vector — single-instance production deployment.
 #
 # Quick start:
-#   1. Create a .env file next to this compose file containing at minimum:
+#   1. Log in to the registry so compose can pull:
+#        docker login gitea.thewrightserver.net
+#
+#   2. Create a .env file next to this compose file containing at minimum:
 #        JWT_SECRET=<64+ char random hex>
 #        CLIENT_ORIGIN=http://your-host:8080
 #        WEB_PORT=8080
-#      For registry-pushed images (optional):
+#        TAG=latest            # or a specific commit SHA
-#        REGISTRY_URL=registry.example.com/josh
-#        TAG=latest
 #
-#   2. Bring up the stack:
+#   3. Pull + start:
-#        docker compose up -d --build
-#      or pull pre-built images from the registry:
 #        docker compose pull && docker compose up -d
 #
 # Data lives in the `vector-data` volume (SQLite db). Redis is included
@@ -24,10 +23,7 @@ x-restart: &restart
 services:
   api:
     <<: *restart
-    image: ${REGISTRY_URL:-vector}/vector-api:${TAG:-latest}
+    image: gitea.thewrightserver.net/josh/vector-api:${TAG:-latest}
-    build:
-      context: .
-      dockerfile: apps/api/Dockerfile
     environment:
       NODE_ENV: production
       PORT: 3001
@@ -48,10 +44,7 @@ services:
 
   web:
     <<: *restart
-    image: ${REGISTRY_URL:-vector}/vector-web:${TAG:-latest}
+    image: gitea.thewrightserver.net/josh/vector-web:${TAG:-latest}
-    build:
-      context: .
-      dockerfile: apps/web/Dockerfile
     ports:
       - "${WEB_PORT:-8080}:80"
     depends_on: