Deploy through the runner's Docker socket instead of SSH

The runner lives on the deployment server, so the deploy job runs
docker compose locally with a temporary registry login.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/docker-compose.yml

@@ -1,9 +1,9 @@
 # Server deployment: runs the prebuilt image from the Gitea registry behind Nginx Proxy Manager.
 # NPM terminates HTTPS and forwards to http://vending-machine-game:80 on the frontend_proxy network.
-# IMAGE is set in .env next to this file (CI writes it on every deploy).
+# IMAGE is the full registry reference, set by the CI deploy job.
 services:
   game:
-    image: ${IMAGE:?set IMAGE in .env}
+    image: ${IMAGE:?set IMAGE}
     container_name: vending-machine-game
     restart: unless-stopped
     environment: