build(deploy): build images on the server instead of publishing to a registry

- deploy/compose.yaml: every app service has `build:` (repo root context),
  local tags pipu-music-<service>:<version>
- deploy/update.sh: git fetch → checkout tag (latest release by default,
  or vX.Y.Z / main) → docker compose build --pull → up -d → prune → /readyz;
  re-executes from a temp copy because checkout may replace the script
- install.sh / .env.example: no REGISTRY, PIPU_VERSION set by update.sh,
  .env owned by the invoking user
- release.yml: drop image publishing; release ships APK + sha256 only
- ci.yml: new `docker` job builds all images without push
- docs: install guide uses git clone, deployment/ci-cd updated, ADR-013

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/.env.example

@@ -1,9 +1,8 @@
 # Скопируйте в .env (install.sh делает это сам и генерирует секреты). Описание — docs/deployment.md.
 
-# --- Образы ---
-# Реестр Gitea: <хост>/<владелец>, например gitea.hsrv.site/mrleo1nid
-REGISTRY=git.example.lan/owner
-PIPU_VERSION=0.1.0
+# --- Версия и данные ---
+# PIPU_VERSION проставляет update.sh по git-тегу — вручную не менять
+PIPU_VERSION=dev
 PIPU_DATA=/srv/pipu
 
 # --- Домен и HTTPS (docs/install-guide.md) ---