fix: secure deploy API, remove Docker-in-Docker, add DB backup

- Add web+superadmin middleware to /api/deploy routes
- Return JSON 403 in EnsureUserIsSuperadmin for API requests
- Remove Docker CLI and docker.sock from app container
- Replace docker compose restart with supervisorctl
- Add mysqldump backup step before migrations

_docker/app/Dockerfile

@@ -33,13 +33,6 @@ RUN apt-get update && apt-get install -y \
     && curl -fsSL https://deb.nodesource.com/setup_18.x | bash - \
     && apt-get install -y nodejs \
     && npm install -g npm \
-    # Docker CLI for deploy script
-    && apt-get install -y ca-certificates curl gnupg \
-    && install -m 0755 -d /etc/apt/keyrings \
-    && curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
-    && chmod a+r /etc/apt/keyrings/docker.gpg \
-    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list \
-    && apt-get update && apt-get install -y docker-ce-cli docker-compose-plugin \
     # Очистка кэша для уменьшения размера образа
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
@@ -63,10 +56,8 @@ RUN curl -sS https://getcomposer.org/installer | php -- \
 RUN mkdir -p storage/framework/views storage/framework/sessions storage/framework/cache storage/logs bootstrap/cache
 
 # Добавляем www-data в группу с GID=1000 (совпадает с GID хост-пользователя)
-# и в группу docker для доступа к Docker socket при деплое
 RUN groupadd -g 1000 hostgroup 2>/dev/null || true \
-    && groupadd docker 2>/dev/null || true \
-    && usermod -aG hostgroup -G docker www-data
+    && usermod -aG hostgroup www-data
 
 # Установка правильных прав доступа
 RUN chown -R www-data:www-data storage bootstrap/cache \