chore: move docker/ compose files and infra to repo root

Moved compose.yml, compose.prod.yml, DEPLOY.md, traefik/, and cron/ out
of docker/ into the repo root (docker/ removed). Updated every reference:

- Dockerfile: COPY paths for the cron stage
- .dockerignore: dropped the now-unneeded docker/!docker-cron
  exclude+exception pair (cron/ is just a normal top-level dir now, no
  special-casing needed)
- compose.prod.yml: build context ".." -> "." (Dockerfile and compose
  files are now siblings, not one level apart)
- CLAUDE.md, DEPLOY.md, compose.yml, traefik/epicure.yml,
  cron/run-digest.sh, weekly-digest route.ts: path references in comments/
  docs

Verified: both compose files validate, and all three Dockerfile targets
(runner/cron/migrator) build clean via a local --no-cache docker build
from the new layout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cron/crontab

@@ -0,0 +1,2 @@
+# Weekly digest — every Monday at 08:00 UTC.
+0 8 * * 1 /usr/local/bin/run-digest.sh >> /proc/1/fd/1 2>> /proc/1/fd/2

cron/run-digest.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Triggers the weekly digest email send on the `web` service. Run on a schedule
+# by busybox crond (see cron/crontab). Fails loudly (non-zero exit,
+# stderr) but crond just tries again next week — no retry loop here on purpose,
+# keep this script trivial.
+set -eu
+
+: "${WEB_INTERNAL_URL:=http://web:3000}"
+
+if [ -z "${CRON_SECRET:-}" ]; then
+  echo "run-digest: CRON_SECRET is not set, refusing to call the digest endpoint" >&2
+  exit 1
+fi
+
+curl -fsS -X POST \
+  -H "Authorization: Bearer ${CRON_SECRET}" \
+  "${WEB_INTERNAL_URL}/api/internal/cron/weekly-digest"