fix: remove sudo from deploy script, use docker compose directly

deploy user has no sudo for systemctl. Instead:
- Use 'docker compose up -d --force-recreate' to recreate the web
  container without needing systemctl
- Change Restart=always so systemd re-attaches after the container
  is recreated
- Replace 'sudo journalctl' with 'docker compose logs' in error path

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

deploy/deploy.sh

@@ -15,11 +15,8 @@ cp "${APP_DIR}/docker-compose.prod.yml" "${SITE_DIR}/docker-compose.prod.yml"
 echo "==> Ensuring static/media directories exist"
 mkdir -p "${SITE_DIR}/static" "${SITE_DIR}/media"
 
-echo "==> Building image"
-docker compose -f "${SITE_DIR}/docker-compose.prod.yml" build --no-cache
-
-echo "==> Restarting service"
-sudo systemctl restart sum-nohype
+echo "==> Rebuilding and recreating web container"
+docker compose -f "${SITE_DIR}/docker-compose.prod.yml" up -d --no-deps --build --force-recreate web
 
 echo "==> Waiting for health check"
 for i in $(seq 1 30); do
@@ -30,5 +27,5 @@ for i in $(seq 1 30); do
   sleep 3
 done
 echo "ERROR: site did not come up after 90s" >&2
-sudo journalctl -u sum-nohype --no-pager -n 50
+docker compose -f "${SITE_DIR}/docker-compose.prod.yml" logs --tail=50 web
 exit 1

deploy/sum-nohype.service

@@ -13,7 +13,7 @@ ExecStartPre=docker compose -f docker-compose.prod.yml pull --ignore-pull-failur
 ExecStart=docker compose -f docker-compose.prod.yml up --build
 ExecStop=docker compose -f docker-compose.prod.yml down
 
-Restart=on-failure
+Restart=always
 RestartSec=10
 TimeoutStartSec=300
 TimeoutStopSec=30