feat(docker): image-based prod stack (Dockerfiles + prod compose + push script)

Adds a pull-based production option so the host no longer builds/installs deps
on every restart:
- backend/Dockerfile + scrobble/Dockerfile bake the heavy deps (ffmpeg, Deno,
  yt-dlp, node libs). Backend still refreshes yt-dlp on start (non-fatal).
- docker-compose.prod.yml pulls ${REGISTRY}/novasonic-*:${TAG}.
- scripts/build-push-images.mjs (npm run push-images) builds + pushes all three.
- .env.example documents every var incl. REGISTRY/TAG; .env gitignored.

The build-on-host docker-compose.yml stays as-is.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -1,20 +1,32 @@
-# Copy to .env and fill in your values
+# Copy to .env next to your docker-compose file and fill in.  cp .env.example .env
+# Used by docker-compose.yml (build-on-host) AND docker-compose.prod.yml (pulls images).
 
-# Pre-fills the URLs on the setup screen
-NAVIDROME_URL=https://music.yourdomain.com
-BACKEND_URL=https://novasonic-api.yourdomain.com
-SCROBBLE_URL=https://novasonic-scrobble.yourdomain.com   # play-log / stats service (port 3710)
+# ── URLs pre-filled on the frontend setup screen ─────────────────────────────
+NAVIDROME_URL=https://music.example.com
+BACKEND_URL=https://backend.example.com
+SCROBBLE_URL=https://scrobble.example.com
 
-# Absolute path to your Navidrome music library on the host
-MUSIC_PATH=/srv/navidrome/music
-
-AUDIO_FMT=mp3          # mp3 | flac | opus | best  (used by yt-dlp)
-AUDIO_QUALITY=0        # 0 = best quality           (used by yt-dlp)
+# ── Library / downloads (backend) ────────────────────────────────────────────
+# Absolute music path — mounted 1:1 into the backend (no remapping), same value inside the container.
+MUSIC_PATH=/opt/navidrome/music
+AUDIO_FMT=mp3
+AUDIO_QUALITY=0
 MAX_PARALLEL=2
-
 DOWNLOAD_BACKEND=ytdlp
-
-# Ticketmaster Events (optional — free API key)
-# 1. Sign up at https://developer.ticketmaster.com/
-# 2. Create an app — copy the Consumer Key
 TICKETMASTER_API_KEY=
+
+# ── Android APK download button + in-app updater ─────────────────────────────
+# The backend proxies the fixed Gitea release ("apk-latest") over the LAN, so Gitea can stay internal.
+GITEA_URL=http://192.168.2.51:3000       # internal Gitea base reachable from the backend container
+GITEA_REPO=Docker/NovaSonic
+GITEA_TOKEN=                              # read token (only needed for a private repo)
+GITEA_APK_TAG=apk-latest
+
+# ── Pre-built images (docker-compose.prod.yml only) ──────────────────────────
+# REGISTRY = where `npm run push-images` pushed to and where the host pulls from.
+#   Gitea container registry (lowercase owner):  gitea.honeyy.duckdns.org/docker
+#   Docker Hub:                                  docker.io/youruser
+# Plain-HTTP internal registries need the host's Docker daemon to allow it
+# (/etc/docker/daemon.json → {"insecure-registries":["192.168.2.51:3000"]}).
+REGISTRY=gitea.honeyy.duckdns.org/docker
+TAG=latest