fix: secure deploy API, remove Docker-in-Docker, add DB backup

- Add web+superadmin middleware to /api/deploy routes
- Return JSON 403 in EnsureUserIsSuperadmin for API requests
- Remove Docker CLI and docker.sock from app container
- Replace docker compose restart with supervisorctl
- Add mysqldump backup step before migrations

app/Ship/Middleware/EnsureUserIsSuperadmin.php

@@ -18,6 +18,10 @@ class EnsureUserIsSuperadmin
     public function handle(Request $request, Closure $next)
     {
         if (!Auth::check() || !Auth::user()->hasRole('super_admin')) {
+            if ($request->expectsJson() || $request->is('api/*')) {
+                return response()->json(['error' => 'Forbidden'], 403);
+            }
+
             return Inertia::render('Error', ['status' => 403])
                 ->toResponse($request)
                 ->setStatusCode(403);