feat: 部署改为 git 驱动，容器以宿主用户运行

服务器实测可经 Cloudflare 443 访问 Gitea 且 git 协议正常（此前我只测了 13000 端口就断言不可达，是错的），因此不再需要 tar + SFTP。

- docker-compose: 增加 user: "1000:1000"。容器此前以 root 运行，写进挂载目录的每轮 jsonl 产物都是 root 属主，导致宿主用户连自己的部署目录都挪不动 —— 这在把部署迁到 /mnt/data 时实际发生了
- deploy.sh: 一条命令走完 拉代码 →（webui/ 有改动时）重建前端 → 重启容器。前端产物 api/webui 是 gitignore 的，git pull 带不过来，必须在服务器上重建一次
- Dockerfile: 补 npm 包。corepack 只管 yarn/pnpm 不管 npm，而前端要在服务器上重建；这样服务器只需要 Docker，不必另配 Node 环境

Dockerfile

@@ -29,7 +29,9 @@ ENV PYTHONUNBUFFERED=1 \
 # every stored timestamp in UTC. nodejs is for PyExecJS: douyin/help.py compiles
 # libs/douyin.js at *import* time, and because main.py imports every platform,
 # that single platform being importable-or-not decides whether the whole app
-# (and the environment self-check) comes up.
+# (and the environment self-check) comes up. npm rides along so the WebUI can be
+# rebuilt on the server (see deploy.sh) instead of only on a workstation --
+# corepack is present but does not cover npm, only yarn and pnpm.
 #
 # The pip mirror is set for the same reason as the apt one: this host's route to
 # the public index is slow.
@@ -44,7 +46,7 @@ RUN set -eux; \
     apt-get install -y --no-install-recommends \
         build-essential pkg-config default-libmysqlclient-dev \
         libgl1 libglib2.0-0 libsm6 libxext6 libxrender1 libxcb1 libgomp1 \
-        tzdata nodejs; \
+        tzdata nodejs npm; \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app