Deploy: complete the compose flattening (paths + script pointer)

Fixes the previous commit, which went out incomplete: a stale pathspec made
its `git add` abort, so the file move landed without the edits that make the
moved file work.

- docker-compose.yml: build contexts `..` -> `.` and the backup sidecar mounts
  ./docker/backup.sh, both now correct for a file at the repo root. Header
  explains why it lives here and to keep newer compose features out of it.
- deploy/webmail.sh: COMPOSE_FILE points at the root file, not the deleted
  docker/docker-compose.prod.yml.

8ddac22 on its own could not start: every build context and the backup mount
pointed one directory too high, and the control script referenced a file that
no longer exists.

Re-verified after this commit with `docker compose up -d --wait` from the repo
root: all services healthy, app serving, backup sidecar resolving its script.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nux3LCu4zP9nih4BRhPyHw

deploy/webmail.sh

@@ -19,7 +19,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(dirname "$SCRIPT_DIR")"
-COMPOSE_FILE="${ROOT_DIR}/docker/docker-compose.prod.yml"
+COMPOSE_FILE="${ROOT_DIR}/docker-compose.yml"
 ENV_FILE="${ROOT_DIR}/docker/.env.prod"
 ENV_EXAMPLE="${ROOT_DIR}/docker/.env.prod.example"
 

docker-compose.yml

@@ -6,14 +6,25 @@
 #   Snapshot Replication, HBS3) can actually see it.
 #
 #   Nothing is published except ${WEB_PORT}. Postgres, Redis, Meilisearch and the
-#   API are reachable only on the internal `webmail` network.
+#   API are reachable only on the internal `webmail-prod` network.
+#
+#   This file lives at the repo ROOT on purpose. Synology Container Manager and
+#   QNAP Container Station build a project from a folder and read
+#   `docker-compose.yml` from it, and DSM's validator rejects newer compose
+#   features (`include:` among them) — so this is one plain, flat file with no
+#   indirection. Keep it that way.
+#
+#   Note `docker/docker-compose.yml` is something else entirely: the throwaway
+#   DEV service stack (Postgres/Redis/Meilisearch/GreenMail on dev ports). Do
+#   not point a NAS project at the docker/ folder.
 #
 #   Start:  ./deploy/webmail.sh up
-#   Manual: docker compose --env-file docker/.env.prod -f docker/docker-compose.prod.yml up -d
+#   Manual: docker compose up -d          (reads .env from this directory)
+#
+#   Project name is deliberately NOT "webmail": docker/docker-compose.yml uses
+#   that, and two compose files sharing one project name fight over each other's
+#   containers — running `make up` would stop production.
 
-# Deliberately NOT "webmail": docker/docker-compose.yml (the dev service stack)
-# uses that project name, and two compose files sharing one project name fight
-# over each other's containers — running `make up` would stop production.
 name: webmail-prod
 
 x-logging: &logging
@@ -24,7 +35,7 @@ x-logging: &logging
 x-backend-image: &backend-image
   image: ${REGISTRY_PREFIX:-webmail}/backend:${IMAGE_TAG:-local}
   build:
-    context: ..
+    context: .
     dockerfile: docker/Dockerfile.backend
     args:
       APP_VERSION: ${IMAGE_TAG:-local}
@@ -253,7 +264,7 @@ services:
   web:
     image: ${REGISTRY_PREFIX:-webmail}/web:${IMAGE_TAG:-local}
     build:
-      context: ..
+      context: .
       dockerfile: docker/Dockerfile.frontend
       args:
         APP_VERSION: ${IMAGE_TAG:-local}
@@ -294,7 +305,7 @@ services:
       TZ: ${TZ:-UTC}
     volumes:
       - ${DATA_ROOT}/backups:/backups
-      - ./backup.sh:/usr/local/bin/backup.sh:ro
+      - ./docker/backup.sh:/usr/local/bin/backup.sh:ro
     depends_on:
       postgres: { condition: service_healthy }
       init: { condition: service_completed_successfully }