feat(docker): split compose into dev-forward build and prod pull

docker-compose.yml now builds from source (dev-forward: run your local changes);
docker-compose.prod.yml overrides it to pull ghcr latest (build reset via !reset).
Adds make compose-up / compose-up-prod / compose-down. Env, ports, and extra_hosts
stay defined once in the base file; the prod override only swaps build -> image.

Makefile

@@ -4,7 +4,8 @@
 
 .PHONY: bootstrap dev dev-web dev-desktop \
         build test test-e2e lint lint-fix typecheck check \
-        ci-web ci-desktop smoke-docker install help
+        ci-web ci-desktop smoke-docker \
+        compose-up compose-up-prod compose-down install help
 
 help:
 	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS=":.*?## "}; {printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}'
@@ -50,5 +51,14 @@ ci-desktop: ## CI: cargo-check for @openconcho/desktop
 smoke-docker: ## Local: build the image + smoke-test the /api proxy (Docker required)
 	bash docker/smoke-test.sh
 
+compose-up: ## Run the web container from source (builds; dev-forward) at :8080
+	docker compose up -d --build
+
+compose-up-prod: ## Run the web container from the published image (pulls latest)
+	docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+
+compose-down: ## Stop and remove the web container
+	docker compose down --remove-orphans
+
 install: ## pnpm install (no playwright)
 	pnpm install