feat(deploy): three deployment modes + prebuilt multi-arch image for robust self-hosting

Make Backspace self-hostable in any homelab environment, not just a clean host
that owns ports 80/443.

install.sh is now mode-aware and auto-detects which fits:
  - allinone (default): bundled Caddy + auto-HTTPS — unchanged behavior
  - proxy: behind your own reverse proxy (nginx / Traefik / Caddy / Nginx Proxy
    Manager / SWAG) — app published on 127.0.0.1:APP_PORT, no bundled Caddy,
    prints paste-ready proxy snippets
  - tunnel: behind a tunnel (Cloudflare / Tailscale) — same, plus a 90MB upload
    cap (under Cloudflare's 100MB body limit) and voice force-disabled (WebRTC
    over UDP can't traverse a tunnel)

Port detection is Docker-aware (consults `docker ps` published ports, not just
`ss`), so a host whose proxy already owns 80/443 via iptables DNAT — with no
listening socket for `ss` to see — is correctly detected as "taken" instead of
dead-ending.

docker-compose.proxy.yml is a small overlay, layered via COMPOSE_FILE (written
into .env so no `-f` flags are ever needed), that publishes the loopback port and
parks Caddy in an inert profile. The base compose file is untouched, so All-in-One
behaves exactly as before.

Prebuilt image: .github/workflows/docker-publish.yml builds and pushes a
multi-arch (linux/amd64 + linux/arm64) image to ghcr.io/thezwiss/backspace on
release tags (and manual dispatch), so weak/ARM hosts skip the ~1.6GB local build
(the Vite build OOMs small ARM boxes). install.sh and docker-compose.yml default
to pulling it, fall back to an image already present on the host, and finally to a
from-source build — AGPL §13 commit stamping preserved on every path. Kept
deliberately separate from the desktop-installer workflow (release.yml).

Docs: README gains a "Deployment modes" section (all three modes, nginx / Caddy /
Traefik snippets, GUI-proxy field-by-field, cloudflared ingress, the update path,
and voice-per-mode caveats); docs/systems/deployment.md updated to match.

Verified live on a throwaway VM: proxy + all-in-one end-to-end through install.sh
(with a real Let's Encrypt cert), tunnel config generation, loopback-only binding,
and the local-image fallback path.

docker-compose.proxy.yml

@@ -0,0 +1,36 @@
+# ============================================================
+# Backspace — Reverse-proxy / Tunnel override
+# ============================================================
+# Overlay for Mode 2 (behind your own reverse proxy) and Mode 3 (tunnel, e.g.
+# Cloudflare Tunnel / Tailscale). Layer it on top of the base compose file:
+#
+#   docker compose -f docker-compose.yml -f docker-compose.proxy.yml up -d
+#
+# What it changes versus the all-in-one base:
+#   1. Publishes the app on 127.0.0.1:${APP_PORT} (loopback only) so your own
+#      reverse proxy or tunnel daemon on the same host can reach it. Nothing is
+#      exposed on a public interface by this stack — TLS/termination is the
+#      proxy's job.
+#   2. Moves the bundled Caddy into a profile that is never activated here, so it
+#      does NOT start (your proxy owns 80/443). The base file leaves Caddy in the
+#      default profile, so Mode 1 (`-f docker-compose.yml` alone) is unchanged.
+#
+# ./install.sh selects the right `-f` combination automatically per mode; this
+# file is also usable by hand for a fully manual setup.
+# ============================================================
+
+services:
+  backspace:
+    # Bind to loopback only. The reverse proxy / tunnel connects over 127.0.0.1;
+    # the app is never reachable directly from the network. Container listens on
+    # PORT (default 3000); APP_PORT is the host-side port your proxy forwards to.
+    ports:
+      - "127.0.0.1:${APP_PORT:-8080}:${PORT:-3000}"
+
+  caddy:
+    # Park Caddy in a profile that install.sh / the documented commands never
+    # enable, so the merged config drops it in proxy/tunnel mode. (Compose
+    # replaces the `profiles` list on merge; the base service has none, so this
+    # is the effective value only when this override is layered on.)
+    profiles:
+      - _proxy_mode_no_caddy