refactor: move deployment files from web/ to repo root

Moves Dockerfile, docker-compose.yml, docker-compose.prod.yml, deploy.sh,
litestream.yml, and router/ from web/ to the monorepo root so copier update
can manage them from the template.

Dockerfile updated for monorepo layout:
- CSS build stage: COPY web/src/ ./web/src/ (Tailwind input path updated)
- Python build stage: copies root uv.lock + web/pyproject.toml separately,
  runs `uv sync --package beanflows` (not full workspace sync)
- Runtime CSS copy path updated to web/src/beanflows/static/css/output.css

deploy.sh: fixed sops path ($APP_DIR/.env.prod.sops, was $APP_DIR/../)

supervisor.py:
- web_code_changed(): Dockerfile path is now root-level (was web/Dockerfile)
- tick(): deploy script is now ./deploy.sh (was ./web/deploy.sh)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,56 @@
+services:
+  app:
+    build: .
+    restart: unless-stopped
+    ports:
+      - "5000:5000"
+    volumes:
+      - ./data:/app/data
+      - ./duckdb:/app/duckdb:ro
+    env_file: .env
+    environment:
+      - DATABASE_PATH=/app/data/app.db
+      - SERVING_DUCKDB_PATH=/app/duckdb/analytics.duckdb
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  worker:
+    build: .
+    restart: unless-stopped
+    command: python -m beanflows.worker
+    volumes:
+      - ./data:/app/data
+    env_file: .env
+    environment:
+      - DATABASE_PATH=/app/data/app.db
+    depends_on:
+      - app
+
+  scheduler:
+    build: .
+    restart: unless-stopped
+    command: python -m beanflows.worker scheduler
+    volumes:
+      - ./data:/app/data
+    env_file: .env
+    environment:
+      - DATABASE_PATH=/app/data/app.db
+    depends_on:
+      - app
+
+  # Optional: Litestream for backups
+  litestream:
+    image: litestream/litestream:latest
+    restart: unless-stopped
+    command: replicate -config /etc/litestream.yml
+    volumes:
+      - ./data:/app/data
+      - ./litestream.yml:/etc/litestream.yml:ro
+    depends_on:
+      - app
+
+volumes: