Replace the remaining deploy procedures with CTXD runbook pointers

The repository still carried operating steps from the deleted runbook:
secret creation and permission commands in deploy/.env.example, build,
restart and restore steps in deploy/compose.yaml, a direct
"docker compose up -d" in mealquest-firewall.service, a manual run in
mealquest-media-backup.service and a dev start command in
compose.dev.yaml. Replace each with a pointer to the named section of
CTXD project mealquest, RUNBOOKS.MD, keeping every variable, path,
owner, mode, port and mount description.

Maestro task e81ed994-a510-48e6-9cf6-e76d5d81f56c.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/mealquest-firewall.service

@@ -5,8 +5,9 @@
 # are one-way: a failure here fails this unit visibly and never fails
 # docker.service.
 #
-# Start MealQuest only after this unit has succeeded:
-#   systemctl start mealquest-firewall && docker compose up -d
+# mealquest.service requires this unit and starts the stack only after it
+# has succeeded. Installing and operating both: CTXD project mealquest,
+# RUNBOOKS.MD "Host firewall" and "Stack unit".
 [Unit]
 Description=Restrict MealQuest port 8090 to Traefik (DOCKER-USER)
 After=docker.service