refactor: move deployment files from web/ to repo root

Moves Dockerfile, docker-compose.yml, docker-compose.prod.yml, deploy.sh,
litestream.yml, and router/ from web/ to the monorepo root so copier update
can manage them from the template.

Dockerfile updated for monorepo layout:
- CSS build stage: COPY web/src/ ./web/src/ (Tailwind input path updated)
- Python build stage: copies root uv.lock + web/pyproject.toml separately,
  runs `uv sync --package beanflows` (not full workspace sync)
- Runtime CSS copy path updated to web/src/beanflows/static/css/output.css

deploy.sh: fixed sops path ($APP_DIR/.env.prod.sops, was $APP_DIR/../)

supervisor.py:
- web_code_changed(): Dockerfile path is now root-level (was web/Dockerfile)
- tick(): deploy script is now ./deploy.sh (was ./web/deploy.sh)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,34 @@
+# CSS build stage (Tailwind standalone CLI, no Node.js)
+FROM debian:bookworm-slim AS css-build
+ADD https://github.com/tailwindlabs/tailwindcss/releases/latest/download/tailwindcss-linux-x64 /usr/local/bin/tailwindcss
+RUN chmod +x /usr/local/bin/tailwindcss
+WORKDIR /app
+COPY web/src/ ./web/src/
+RUN tailwindcss -i ./web/src/beanflows/static/css/input.css \
+    -o ./web/src/beanflows/static/css/output.css --minify
+
+
+# Build stage
+FROM python:3.12-slim AS build
+COPY --from=ghcr.io/astral-sh/uv:0.8 /uv /uvx /bin/
+WORKDIR /app
+ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy
+COPY uv.lock pyproject.toml README.md ./
+COPY web/pyproject.toml web/README.md ./web/
+COPY web/src/ ./web/src/
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --no-dev --frozen --package beanflows
+
+# Runtime stage
+FROM python:3.12-slim AS runtime
+ENV PATH="/app/.venv/bin:$PATH"
+RUN useradd -m -u 1000 appuser
+WORKDIR /app
+RUN mkdir -p /app/data && chown -R appuser:appuser /app
+COPY --from=build --chown=appuser:appuser /app .
+COPY --from=css-build /app/web/src/beanflows/static/css/output.css ./web/src/beanflows/static/css/output.css
+USER appuser
+ENV PYTHONUNBUFFERED=1
+ENV DATABASE_PATH=/app/data/app.db
+EXPOSE 5000
+CMD ["hypercorn", "beanflows.app:app", "--bind", "0.0.0.0:5000", "--workers", "1"]