Document Docker rebuild after git pull (Task #549)

Root cause of "service images don't show on the Mac after pulling latest":
the SPA is baked into the nginx (`web`) image and the API binary is baked
into the `api` image at `docker compose build` time. Running just
`git pull && docker compose up -d` reuses the existing images, so new
static assets in `artifacts/tx-os/public/` (and any front-end / API code
changes) never reach the browser.

Changes:
- New `scripts/redeploy.sh` — single-command redeploy. Steps:
  1. git pull --ff-only (skip with --no-pull)
  2. docker compose build api web
  3. docker compose run --rm migrate  (drizzle push + idempotent seed)
  4. docker compose up -d
  Detects `docker compose` v2 vs legacy `docker-compose`, runs from any
  cwd via BASH_SOURCE, set -euo pipefail, --help prints the header.
  chmod +x. Verified `bash -n` and `--help`.
- `replit.md` — new "Redeploying after `git pull` (Docker hosts)"
  section that calls out the gotcha and points at the script.
- `DEPLOYMENT_MIGRATION.md` — one-line cross-reference at the top of
  the deploy section so anyone reading deploy docs finds the script.

No code or runtime behavior changed. No follow-ups proposed: the only
natural next step (PWA full-screen) is already tracked as Task #550.

DEPLOYMENT_MIGRATION.md

@@ -106,6 +106,8 @@ and running the documented commands produces a working deployment.
 
 ## Operational notes for first-time deploy
 
+> **Updating an existing deploy after `git pull`?** Use `./scripts/redeploy.sh` — it rebuilds the `api` and `web` images, runs migrations + seed, and restarts the stack in the right order. See `replit.md` → "Redeploying after `git pull`".
+
 1. `cp .env.example .env` and fill in every value.
 2. `docker compose build`
 3. `docker compose up -d db minio minio-init` — Postgres + MinIO + create

scripts/redeploy.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Tx OS — redeploy after `git pull` on the Mac (or any Docker host).
+#
+# Why this exists:
+#   The SPA is baked into the `web` (nginx) image at build time, and the
+#   API binary is baked into the `api` image. `docker compose up -d` on
+#   its own re-uses the existing images, so a plain `git pull` will NOT
+#   pick up new front-end assets (e.g. service tile images), code
+#   changes, or DB-seed updates.
+#
+# What it does:
+#   1. git pull           — fast-forward the working tree (skipped with --no-pull)
+#   2. docker compose build api web
+#                          — rebuild both images so source + static assets are fresh
+#   3. docker compose run --rm migrate
+#                          — apply Drizzle schema + run the seed (idempotent)
+#   4. docker compose up -d
+#                          — restart api + web with the new images
+#
+# Safe to re-run. Each step is idempotent.
+
+set -euo pipefail
+
+PULL=1
+for arg in "$@"; do
+  case "$arg" in
+    --no-pull) PULL=0 ;;
+    -h|--help)
+      sed -n '2,21p' "$0"
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $arg" >&2
+      echo "Usage: $0 [--no-pull]" >&2
+      exit 2
+      ;;
+  esac
+done
+
+# Resolve the repo root so the script works no matter where it's invoked from.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
+
+if [ ! -f docker-compose.yml ]; then
+  echo "[redeploy] error: docker-compose.yml not found in $REPO_ROOT" >&2
+  exit 1
+fi
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "[redeploy] error: docker CLI not found in PATH" >&2
+  exit 1
+fi
+
+# Pick `docker compose` (v2) and fall back to `docker-compose` (v1) so this
+# works on older hosts.
+if docker compose version >/dev/null 2>&1; then
+  DC=(docker compose)
+elif command -v docker-compose >/dev/null 2>&1; then
+  DC=(docker-compose)
+else
+  echo "[redeploy] error: neither 'docker compose' nor 'docker-compose' is available" >&2
+  exit 1
+fi
+
+step() { echo; echo "==> $*"; }
+
+if [ "$PULL" -eq 1 ]; then
+  step "1/4  git pull"
+  git pull --ff-only
+else
+  step "1/4  git pull (skipped via --no-pull)"
+fi
+
+step "2/4  docker compose build api web  (rebuilds SPA + API images)"
+"${DC[@]}" build api web
+
+step "3/4  docker compose run --rm migrate  (schema push + seed)"
+"${DC[@]}" run --rm migrate
+
+step "4/4  docker compose up -d  (restart with the new images)"
+"${DC[@]}" up -d
+
+echo
+echo "[redeploy] done. Verify in a browser; hard-refresh once to bust the SPA cache."