Add a one-command SSH deploy for the dev server

deploy/deploy-dev.sh deploys the test instance to home.siebens.org behind its
existing Caddy: from your machine, over one SSH session, it fetches the pushed
branch, builds, migrates explicitly, restarts web, and waits for /healthz.

- A hard reset to origin/<branch>, not a pull: a deploy target only receives
  deploys, so it should match the branch exactly rather than risk a merge conflict
  from drift no one meant to leave on the server.
- Refuses to deploy a branch with unpushed local commits — the server pulls from
  git, so that would ship stale code without saying so.
- Migrations run explicitly (dc run --rm web migrate), never from the entrypoint,
  and only `web` is recreated so db/redis keep running.
- Fails loudly if .env.production or .env is missing rather than booting a
  half-configured stack, and dumps recent web logs if the health check never passes.

Host/user/dir/branch all override via env vars. Documented in DEPLOYMENT.md with
the first-time server setup.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

DEPLOYMENT.md

@@ -298,6 +298,35 @@ A   *.test.rosterchief.app  -> <server ip>
 The compose project is named `rosterchief-test`, so its containers and volumes never collide
 with a production stack on the same host.
 
+### Deploying with one command
+
+Once the server has the repo cloned at `/home/bernard/RosterChief` and its two env files in
+place, `deploy/deploy-dev.sh` does a full deploy over SSH:
+
+```bash
+deploy/deploy-dev.sh            # deploy the current branch
+BRANCH=main deploy/deploy-dev.sh
+deploy/deploy-dev.sh --push     # push the branch first, then deploy
+```
+
+It runs from your machine and does the work on the server in one SSH session: fetch the pushed
+branch (a hard reset to `origin/<branch>`, since a deploy target only receives deploys), build
+the image, run migrations *explicitly*, restart only `web`, and wait for `/healthz`.
+
+It refuses to deploy a branch whose local commits are not pushed — the server pulls from git,
+so unpushed work would ship stale code silently. Override the host, user, directory or branch
+with the `SSH_HOST` / `SSH_USER` / `REMOTE_DIR` / `BRANCH` environment variables.
+
+First-time setup on the server, once:
+
+```bash
+git clone git@git.siebens.org:bernard/RosterChief.git /home/bernard/RosterChief
+cd /home/bernard/RosterChief
+cp .env.compose.example .env             # fill in POSTGRES_PASSWORD etc.
+cp .env.production.example .env.production
+# then add the reverse_proxy site block to the host's Caddy (see above)
+```
+
 ## Automated backups
 
 `deploy/backup.sh` dumps the database, tars the uploads while they are still on local disk,