feat(docker): pull-based prod stack (docker-compose.prod.yml + Registry-Images)

Produktivsystem baut nicht mehr selbst, sondern zieht die drei fertigen Images
(novasonic-frontend/-backend/-scrobble) aus der Gitea-Registry. Das bestehende
docker-compose.yml bleibt der Build-auf-dem-Host-Weg. Dazu .dockerignore fuers
Frontend-Image (android/, backend/, .git raus) und README/CLAUDE.md aktualisiert.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -46,8 +46,14 @@ Backend runs in Docker via **`docker-compose.yml`**, which **builds locally from
 baked into the images, so container **restarts are instant** and a rebuild after `git pull` is fast
 (Docker caches the dep layers — only the code COPY layer changes). Deploy: `git pull && docker compose
 up -d --build`; a plain restart is `docker compose restart novasonic-backend` (the backend also
-re-pulls the latest yt-dlp on each start). No registry needed — an optional pull-from-registry / CI
-flow can build the same Dockerfiles elsewhere and push (`scripts/build-push-images.mjs`, `.env.example`).
+re-pulls the latest yt-dlp on each start). No registry needed for that path.
+
+**Produktivsystem zieht stattdessen fertige Images** — `docker-compose.prod.yml` referenziert
+`${REGISTRY}/novasonic-frontend|-backend|-scrobble:${TAG:-latest}` und baut nichts:
+`docker compose -f docker-compose.prod.yml pull && … up -d`. Gepusht wird von der Dev-Maschine mit
+`npm run push-images` (`scripts/build-push-images.mjs`, liest `REGISTRY`/`TAG` aus `.env`); ohne Node
+tut es direkt `docker build -t $REGISTRY/<name>:latest <context>` + `docker push` mit den Kontexten
+`.`, `backend/`, `scrobble/`. Registry ist die Gitea-Registry (`…/docker`, Owner klein geschrieben).
 
 On the deploy host the music lives at `/opt/navidrome/music`.