Deploy: add pull, the verb a first install from a registry needed

`up` only builds images that are missing locally, and `update` refuses to
run without an existing database to back up — so a fresh install that is
meant to fetch prebuilt images had no command that did it. `pull` fills the
gap and fails loudly if REGISTRY_PREFIX is still the local default.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018SqJYt7jD7oUEkoY68sBZo

deploy/webmail.sh

@@ -2,6 +2,7 @@
 # Webmail operator control script. One command per thing you might need to do.
 #
 #   ./deploy/webmail.sh init            create data dirs + a filled-in .env.prod
+#   ./deploy/webmail.sh pull [tag]      fetch prebuilt images from your registry
 #   ./deploy/webmail.sh up [--meili]    start (builds images if missing)
 #   ./deploy/webmail.sh down            stop (data is untouched)
 #   ./deploy/webmail.sh status          what is running, and which version
@@ -370,6 +371,20 @@ then re-run this command."
     echo "    admin: http://<this-host>:${ADMIN_PORT:-8089}/ — restrict this port to your LAN"
 }
 
+# First install from a registry: `up` only builds what is missing locally, and
+# `update` refuses to run without an existing database to back up. This is the
+# gap between them — fetch the images, then `up` starts them instead of building.
+cmd_pull() {
+    require_env
+    local tag="${1:-${IMAGE_TAG:-local}}"
+    [ "${REGISTRY_PREFIX:-webmail}" = "webmail" ] && die \
+        "REGISTRY_PREFIX is still the local default — nothing to pull from.
+    Set REGISTRY_PREFIX and IMAGE_TAG in ${ENV_FILE}, or use: webmail.sh up --build"
+    detect_compose
+    IMAGE_TAG="$tag" compose pull || die "pull failed — is the registry reachable and logged in?"
+    grn "pulled ${REGISTRY_PREFIX}/{backend,web}:${tag}. Next: ./deploy/webmail.sh up"
+}
+
 cmd_down()    { require_env; compose --profile meili down; grn "stopped (data kept in ${DATA_ROOT})"; }
 cmd_restart() { require_env; compose restart "${@:-}"; }
 
@@ -559,6 +574,7 @@ SUBCOMMAND="$cmd"
 case "$cmd" in
     init)     cmd_init "$@" ;;
     doctor)   cmd_doctor "$@" ;;
+    pull)     cmd_pull "$@" ;;
     up)       cmd_up "$@" ;;
     down)     cmd_down "$@" ;;
     restart)  cmd_restart "$@" ;;