- Add web+superadmin middleware to /api/deploy routes - Return JSON 403 in EnsureUserIsSuperadmin for API requests - Remove Docker CLI and docker.sock from app container - Replace docker compose restart with supervisorctl - Add mysqldump backup step before migrations