refactor: move deployment files from web/ to repo root

Moves Dockerfile, docker-compose.yml, docker-compose.prod.yml, deploy.sh,
litestream.yml, and router/ from web/ to the monorepo root so copier update
can manage them from the template.

Dockerfile updated for monorepo layout:
- CSS build stage: COPY web/src/ ./web/src/ (Tailwind input path updated)
- Python build stage: copies root uv.lock + web/pyproject.toml separately,
  runs `uv sync --package beanflows` (not full workspace sync)
- Runtime CSS copy path updated to web/src/beanflows/static/css/output.css

deploy.sh: fixed sops path ($APP_DIR/.env.prod.sops, was $APP_DIR/../)

supervisor.py:
- web_code_changed(): Dockerfile path is now root-level (was web/Dockerfile)
- tick(): deploy script is now ./deploy.sh (was ./web/deploy.sh)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

litestream.yml

@@ -0,0 +1,22 @@
+# Litestream configuration for SQLite replication
+# Supports S3, Cloudflare R2, MinIO, etc.
+
+dbs:
+  - path: /app/data/app.db
+    replicas:
+      # Option 1: AWS S3
+      # - url: s3://your-bucket/beanflows/app.db
+      #   access-key-id: ${AWS_ACCESS_KEY_ID}
+      #   secret-access-key: ${AWS_SECRET_ACCESS_KEY}
+      #   region: us-east-1
+      
+      # Option 2: Cloudflare R2
+      # - url: s3://your-bucket/beanflows/app.db
+      #   access-key-id: ${R2_ACCESS_KEY_ID}
+      #   secret-access-key: ${R2_SECRET_ACCESS_KEY}
+      #   endpoint: https://${R2_ACCOUNT_ID}.r2.cloudflarestorage.com
+      
+      # Option 3: Local file backup (for development)
+      - path: /app/data/backups
+        retention: 24h
+        snapshot-interval: 1h