build(deploy): build images on the server instead of publishing to a registry

- deploy/compose.yaml: every app service has `build:` (repo root context),
  local tags pipu-music-<service>:<version>
- deploy/update.sh: git fetch → checkout tag (latest release by default,
  or vX.Y.Z / main) → docker compose build --pull → up -d → prune → /readyz;
  re-executes from a temp copy because checkout may replace the script
- install.sh / .env.example: no REGISTRY, PIPU_VERSION set by update.sh,
  .env owned by the invoking user
- release.yml: drop image publishing; release ships APK + sha256 only
- ci.yml: new `docker` job builds all images without push
- docs: install guide uses git clone, deployment/ci-cd updated, ADR-013

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose.yaml

@@ -1,7 +1,15 @@
-# Продакшен-развёртывание (docs/deployment.md). Перед первым запуском: sudo ./install.sh
-# Обновление: ./update.sh <version>
+# Продакшен-развёртывание (docs/install-guide.md). Образы собираются на сервере из клонированного репозитория.
+# Перед первым запуском: sudo ./install.sh. Установка / обновление: ./update.sh [vX.Y.Z]
 name: pipu
 
+x-version: &version
+  VERSION: ${PIPU_VERSION:-0.0.0-dev}
+
+x-build-rec: &build-rec
+  context: ..
+  dockerfile: services/recommender/Dockerfile
+  args: *version
+
 x-library-ro: &library-ro
   type: bind
   source: ${PIPU_DATA:-/srv/pipu}/library
@@ -15,7 +23,11 @@ x-restart: &restart
 services:
   nginx:
     <<: *restart
-    image: ${REGISTRY}/pipu-music-web:${PIPU_VERSION}
+    image: pipu-music-web:${PIPU_VERSION:-dev}
+    build:
+      context: ..
+      dockerfile: apps/web/Dockerfile
+      args: *version
     ports: ["${HTTP_PORT:-80}:80"]
     volumes:
       - *library-ro
@@ -25,7 +37,12 @@ services:
 
   api:
     <<: *restart
-    image: ${REGISTRY}/pipu-music-api:${PIPU_VERSION}
+    image: pipu-music-api:${PIPU_VERSION:-dev}
+    build:
+      context: ..
+      dockerfile: services/api/Dockerfile
+      target: api
+      args: *version
     env_file: .env
     environment: &db-env
       DATABASE_URL: postgres://pipu:${POSTGRES_PASSWORD}@postgres:5432/pipu?sslmode=disable
@@ -41,7 +58,12 @@ services:
 
   storage-agent:
     <<: *restart
-    image: ${REGISTRY}/pipu-music-storage-agent:${PIPU_VERSION}
+    image: pipu-music-storage-agent:${PIPU_VERSION:-dev}
+    build:
+      context: ..
+      dockerfile: services/api/Dockerfile
+      target: storage-agent
+      args: *version
     cap_add: [SYS_ADMIN]
     security_opt: ["apparmor:unconfined"]
     environment:
@@ -56,7 +78,8 @@ services:
 
   recommender:
     <<: *restart
-    image: ${REGISTRY}/pipu-music-recommender:${PIPU_VERSION}
+    image: pipu-music-recommender:${PIPU_VERSION:-dev}
+    build: *build-rec
     command: ["serve"]
     env_file: .env
     environment: *db-env
@@ -65,7 +88,8 @@ services:
 
   analyzer:
     <<: *restart
-    image: ${REGISTRY}/pipu-music-recommender:${PIPU_VERSION}
+    image: pipu-music-recommender:${PIPU_VERSION:-dev}
+    build: *build-rec
     command: ["analyze", "--workers", "4"]
     env_file: .env
     environment: *db-env