Add local-network deployment automation and tighten runtime defaults

This commit adds the first complete local-network deployment path for the project. It normalizes the runtime contract around a fixed container listener on 0.0.0.0:10000, binds the published compose port to 127.0.0.1, and keeps the image/build workflow aligned with the released container image.

It also introduces an installation script, an nginx reverse-proxy template, and a safer SQLite backup flow based on sqlite3 .backup with retention and optional rclone upload support. Deployment-oriented configuration has been consolidated into .env.example, repository-local .env files are now ignored, and the deployment scripts are executable.

In addition, the frontend mixed-content issue is fixed by switching the stylesheet reference to a root-relative static path, with tests updated to cover the regression. README guidance has been expanded to document the new install, nginx, backup, and restore conventions.

docker-compose.yml

@@ -4,12 +4,10 @@ services:
     image: "code.wanderingbadger.dev/tliu93/2026-moving-helper:latest"
     build:
       context: .
-    user: "${UID:-1000}:${GID:-1000}"
+    user: "1000:1000"
     ports:
-      - "${PORT:-10000}:${PORT:-10000}"
+      - "127.0.0.1:${APP_PORT:-10000}:10000"
     environment:
-      HOST: ${HOST:-0.0.0.0}
-      PORT: ${PORT:-10000}
       DATABASE_URL: ${DATABASE_URL:-sqlite:////app/data/app.db}
     volumes:
       - ${DATA_DIR:-./data}:/app/data