ci(deploy): switch to libretech/runner-image:v1 and consolidate

The deploy workflow is now a single job that builds, pushes, and
deploys in one runner. Tag computation moved to docker/metadata-action,
the per-deploy .env perl rewrite is gone (host pins LIBRENOTES_IMAGE
once; main pushes update :main rolling, releases pin to :vX.Y.Z by
manual edit), and both jobs run in our bespoke runner image whose
runner user already has socket access via group membership.

ci.yml moves to the same image so go/make/node are all available
without per-step apt installs.

Drops compose.prod.yaml (unused, redundant with compose.netcup.yaml).

.gitea/workflows/ci.yml

@@ -9,10 +9,10 @@ on:
 jobs:
   ci:
     runs-on: ubuntu-latest
-    # Pin image: needs make (not in node:20-bookworm). runner-latest
-    # bundles make, git, curl + node for setup-go.
+    # Bespoke runner image (Ubuntu 24.04 + make + git + node + go via
+    # actions/setup-go). See git.librete.ch/libretech/runner-image.
     container:
-      image: catthehacker/ubuntu:runner-latest
+      image: git.librete.ch/libretech/runner-image:v1
     timeout-minutes: 5
     steps:
       - name: Checkout