fix: secure deploy API, remove Docker-in-Docker, add DB backup

- Add web+superadmin middleware to /api/deploy routes
- Return JSON 403 in EnsureUserIsSuperadmin for API requests
- Remove Docker CLI and docker.sock from app container
- Replace docker compose restart with supervisorctl
- Add mysqldump backup step before migrations

docker-compose.yml

@@ -36,7 +36,6 @@ services:
       dockerfile: _docker/app/Dockerfile
     volumes:
       - ./:/var/www
-      - /var/run/docker.sock:/var/run/docker.sock
     container_name: ntspi-php
     restart: always
     ports: