Replace the remaining deploy procedures with CTXD runbook pointers

The repository still carried operating steps from the deleted runbook:
secret creation and permission commands in deploy/.env.example, build,
restart and restore steps in deploy/compose.yaml, a direct
"docker compose up -d" in mealquest-firewall.service, a manual run in
mealquest-media-backup.service and a dev start command in
compose.dev.yaml. Replace each with a pointer to the named section of
CTXD project mealquest, RUNBOOKS.MD, keeping every variable, path,
owner, mode, port and mount description.

Maestro task e81ed994-a510-48e6-9cf6-e76d5d81f56c.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose.yaml

@@ -1,18 +1,16 @@
-# Production stack for MealQuest on 10.60.1.14 (D-018). Build on the host,
-# then start through systemd:
-#
-#   docker compose -f deploy/compose.yaml build
-#   sudo systemctl restart mealquest
+# Production stack for MealQuest on 10.60.1.14 (D-018). Building, deploying
+# and operating it: CTXD project mealquest, RUNBOOKS.MD "Stack unit" and
+# "Routine deploy and rollback".
 #
 # The services use restart: "no" on purpose: Docker must not start them
 # before the DOCKER-USER firewall is applied. deploy/systemd/mealquest.service
 # owns start and stop and requires mealquest-firewall.service first.
 #
-# Configuration comes from deploy/.env (copy deploy/.env.example) and secrets
-# from deploy/secrets/; neither is committed. Compose bind-mounts file secrets
-# with their host owner and mode, so each file in deploy/secrets/ must be
-# owned by the container user 10001:10001 with mode 0600 (except
-# searxng.env, read by compose itself; see the searxng service).
+# Configuration comes from deploy/.env (template: deploy/.env.example) and
+# secrets from deploy/secrets/; neither is committed. Compose bind-mounts
+# file secrets with their host owner and mode, so each file in
+# deploy/secrets/ must be owned by the container user 10001:10001 with mode
+# 0600 (except searxng.env, read by compose itself; see the searxng service).
 name: mealquest
 
 services:
@@ -65,9 +63,8 @@ services:
   # the app's own user (owner of the volume) with a read-only root
   # filesystem, no privilege escalation and no Linux capabilities.
   #
-  # Restore: follow "Restore the database" in the CTXD project mealquest,
-  # RUNBOOKS.MD (stop the stack, move the database with its -wal and -shm
-  # aside, restore, check).
+  # Restoring the database: CTXD project mealquest, RUNBOOKS.MD "Restore
+  # the database".
   litestream:
     image: litestream/litestream:0.5.17
     user: "10001:10001"