Split the site out, and offer the source the licence requires

The hub page and the games.jcoffey.dev deployment move to their own
private repository; this one keeps only the game, its leaderboard and a
generic compose that runs both anywhere. No deployment details remain
here, and no site references.

A SOURCE link now sits on every screen. AGPL section 13 entitles anyone
playing this over a network to the source of what they are playing, and
a link in the footer is how that offer gets made.

compose.yml

@@ -0,0 +1,52 @@
+# Run the game and its leaderboard locally, or on any host you like.
+#
+#   docker compose up -d --build
+#   -> game      http://localhost:8080
+#      scores    http://localhost:5184/api/scores
+#
+# The game talks to /api, so put both behind one origin in production (see
+# README.md). Nothing here is specific to any particular deployment.
+
+services:
+  lemonade-web:
+    build:
+      context: .
+      dockerfile: web/Dockerfile
+      args:
+        # Where the game is served from. "/" unless it sits under a path.
+        BASE_PATH: /
+    image: lemonade-web:latest
+    restart: unless-stopped
+    ports:
+      - '8080:8080'
+    read_only: true
+    tmpfs:
+      - /tmp
+      - /var/cache/nginx
+      - /var/run
+    security_opt:
+      - no-new-privileges:true
+
+  lemonade-scores:
+    build:
+      context: ./server
+    image: lemonade-scores:latest
+    restart: unless-stopped
+    ports:
+      - '5184:5184'
+    environment:
+      # Set to 1 when something else terminates TLS in front of this, so the
+      # rate limit counts players rather than counting the proxy.
+      TRUST_PROXY: '0'
+      DB_PATH: /data/scores.db
+    # The only writable path, and the only state worth keeping.
+    volumes:
+      - lemonade-scores-data:/data
+    read_only: true
+    tmpfs:
+      - /tmp
+    security_opt:
+      - no-new-privileges:true
+
+volumes:
+  lemonade-scores-data: