perf(deploy): parallel deploys, preserve build cache, prod-only runtime deps

Three changes to cut deploy time:
1. deploy.sh: Pi and VM deploy concurrently (wall time = max, not sum)
2. deploy.sh: Build cache capped at 2GB instead of nuked after 24h,
   so pnpm install layer is reused between deploys
3. Dockerfile: runtime stage uses --prod (skip devDeps). Moved tsx
   from devDependencies to dependencies since it's used in CMD.

pnpm-lock.yaml

@@ -82,6 +82,9 @@ importers:
       sharp:
         specifier: ^0.33.0
         version: 0.33.5
+      tsx:
+        specifier: ^4.16.0
+        version: 4.21.0
     devDependencies:
       '@types/bcryptjs':
         specifier: ^2.4.6
@@ -101,9 +104,6 @@ importers:
       drizzle-kit:
         specifier: ^0.24.0
         version: 0.24.2
-      tsx:
-        specifier: ^4.16.0
-        version: 4.21.0
       typescript:
         specifier: ^5.4.0
         version: 5.9.3