Run from a published image; move source build to docker-compose.build.yaml

docker-compose.yaml now pulls git.goyban.com/goyban/whattodo so it can be used
without the source. publish.sh builds the committed version and pushes it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -18,3 +18,6 @@ BIND_ADDR=127.0.0.1
 
 # Behind a reverse proxy, the IPs allowed to set X-Forwarded-For (for login rate limiting).
 # FORWARDED_ALLOW_IPS=127.0.0.1
+
+# Development only: build from source instead of pulling the published image.
+# COMPOSE_FILE=docker-compose.build.yaml