refactor(deploy): merge the three compose files into a base plus overlays

The dev and prod stacks each declared the same nine services, which is how the
S3 credentials and the gateway configuration ended up diverging. compose.yml
now holds every service with no published port and no domain in it, and the
overlays only add what is specific: host ports and pgAdmin for development,
the nginx edge and the mounted secrets for production. The applications sit
behind the `apps` profile, so a plain `up` still starts infrastructure only.

Everything environment-specific moves to the env files: the public URLs, the
credentials and the environment name. The SeaweedFS identity file is rendered
inside the container from S3_ACCESS_KEY and S3_SECRET_KEY, so the store and
the applications can no longer be given different keys.

.gitignore

@@ -15,10 +15,16 @@ artifacts/
 Thumbs.db
 .DS_Store
 
-# Secrets / local
+# Environment files (deploy/.env, deploy/.env.prod, web-player/.env, ...)
+.env
+.env.*
 *.env
+!.env.example
+!.env.prod.example
 
-# Production env and mounted secrets
-.env.prod
-*.env.*
+# Deploy secrets and runtime state
+deploy/keys/
 deploy/secrets/
+deploy/nginx/certs/
+deploy/zitadel/.output/
+deploy/.tmp/