Add server deployment guide, bind port to localhost

DEPLOY.md: dedicated user with rootless Docker, deploy key, nginx + HTTPS,
updates, backups. The container port is only published on 127.0.0.1 so
nginx is the only way in (Docker would otherwise bypass the firewall).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HJhXuLD2Z6hv3Wqeq9UL9K

docker-compose.yml

@@ -3,7 +3,11 @@ services:
     build: .
     restart: unless-stopped
     ports:
-      - "8080:8000"          # change the host port, or put the container behind a reverse proxy
+      # Only reachable from the server itself; the reverse proxy (nginx) is the public entrance.
+      # Docker bypasses firewall rules for published ports, so never publish this on 0.0.0.0.
+      - "127.0.0.1:8080:8000"
+    security_opt:
+      - no-new-privileges:true
     environment:
       # Code that new users must enter to create an account (set it in the .env file next to this file).
       # Empty = registration is disabled.