Replace deploy scripts with self-contained compose bootstrap jobs

Removes every wrapper script under deploy/ (up.ps1, up.sh, scripts/*,
zitadel/provision.*) and folds their logic into three one-shot services
in compose.yml, following the pattern already used by seaweedfs-init:

  keys-init     generates the RS256 stream-ticket key pair
  migrate       applies the EF Core migrations (backend/Musify.Migrator.Dockerfile)
  zitadel-init  creates the Musify project + OIDC apps, writes the client
                ids back into the active env file

Deploying is now two plain `docker compose` commands, no scripts to run
or chmod:

  docker compose -f deploy/compose.yml -f deploy/compose.dev.yml up -d
  docker compose -f deploy/compose.yml -f deploy/compose.dev.yml --profile apps up -d --build

(swap compose.dev.yml for compose.prod.yml + --env-file deploy/.env.prod
for production). The first command brings up infra and lets the bootstrap
jobs run to completion; the second builds and starts the apps, which by
then read real OIDC values instead of empty ones — compose interpolates
${VAR} once per invocation, so this can't collapse into a single command
without the apps reading their own config file at container start instead
of via compose env (out of scope here).

Also:
- DatabaseDesignTimeFactory now also reads Database__ConnectionString
  from the environment, and DesignSettings.json is optional, so the new
  migrate container works without user-secrets or a config file excluded
  from the Docker build context by .dockerignore.
- nginx's depends_on no longer lists the apps-profile services: it does
  not need them at its own startup (every vhost resolves its upstream at
  request time via the embedded Docker resolver), and requiring them made
  `compose.prod.yml up -d` (without --profile apps) an invalid project.
- env_get/env_set in zitadel-init strip \r: the mounted env file can have
  CRLF line endings on Windows, which otherwise makes an empty-looking
  value non-empty to `[ -z ... ]`. .env.example/.env.prod.example are
  pinned to LF via .gitattributes for the same reason. Also fixed:
  rewriting the bind-mounted env file in place instead of renaming a temp
  file over it (rename onto a bind-mounted inode fails with "Resource
  busy").
- Removed compose.share.yml and zitadel/.output-share/ — a "temporary"
  personal overlay that had leaked a real Zitadel service-account PAT
  into git history (committed in 70968b3). That token should be rotated.
- Removed deploy/.tmp/ from .gitignore: nothing mounts or creates it
  anymore (it never actually did, either — no compose service referenced
  it, only the now-removed up.ps1 did).

Verified end-to-end with Docker: a clean `down -v` + fresh `up -d` +
`--profile apps up -d --build` on the dev stack brings up all four one-shot
jobs successfully and all four apps healthy (api/gateway return 200,
worker starts its consumers with no errors, web-player responds). Also
verified compose.prod.yml starts nginx cleanly with dummy certs and no
apps running, confirming the depends_on fix.

README.md

@@ -7,26 +7,32 @@ and stream them without the bytes ever going through the API.
 ```
 backend/      .NET 10 — Domain / Application / Infrastructure / Api / Worker / StreamingGateway
 web-player/   SvelteKit 2 + Svelte 5 + Tailwind 4 web client
-deploy/       Docker Compose stacks and the scripts that bootstrap them
+deploy/       Docker Compose stacks — self-contained, no wrapper scripts
 docs/         What each piece does and why (in Spanish)
 ```
 
 ## Run it
 
-Development (Windows, Docker Desktop):
+Development (Docker Desktop):
 
-```powershell
-./deploy/up.ps1        # infrastructure; the apps run from the IDE
-./deploy/up.ps1 -Apps  # everything in Docker
+```sh
+docker compose -f deploy/compose.yml -f deploy/compose.dev.yml up -d
 ```
 
+Infrastructure plus stream-ticket keys, database migrations and Zitadel OIDC
+provisioning — all as one-shot jobs baked into the compose file. Apps run from
+the IDE by default; add `--profile apps up -d --build` as a second command to
+run them in Docker instead.
+
 Production, on a server with a domain:
 
 ```sh
-./deploy/up.sh         # fill in deploy/.env.prod and the TLS certs when it asks
+cp deploy/.env.prod.example deploy/.env.prod   # fill in the domain and secrets
+docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml up -d
+docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml --profile apps up -d --build
 ```
 
-Both are idempotent and print what they did. See
+Idempotent — run the same commands again to deploy an update. See
 [deploy/README.md](deploy/README.md) for the details, the port map and the
 production prerequisites.