deploy: split compose into base (prod-ready) + dev override

Compose merges list-typed fields like \`ports\` by concatenation, so the
previous prod overlay couldn't clear the base file's host port binding;
the VPS app ended up listening on both port 80 (intranet) AND host port
8800 simultaneously.

Restructured to the conventional dev/prod split:
- docker-compose.yml: no host port — prod-ready by default
- docker-compose.override.yml: dev-only host port binding (auto-loaded
  by \`docker compose up\` locally, skipped when prod uses explicit -f)
- docker-compose.prod.yml: command-port 80 + intranet network only

Production invocation:
  docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.override.yml

@@ -0,0 +1,9 @@
+# Local-dev overlay. Auto-loaded by `docker compose up` (no -f flags needed),
+# IGNORED on the VPS because prod uses explicit `-f docker-compose.yml -f
+# docker-compose.prod.yml`. Keep dev-only conveniences here so the base
+# `docker-compose.yml` stays prod-ready.
+
+services:
+  app:
+    ports:
+      - "${CASSANDRA_PORT:-8000}:8000"