feat(deploy): padroniza rx p/ Build Once->Promote->Deploy (CI registry, compose.prod, badge/health)

- .gitea/workflows/build.yml: push->build rx-scoreodonto:<sha> no registry; tag->promote+deploy
- docker-compose.prod.yml: image do registry, APP_VERSION/GIT_COMMIT em runtime
- deploy-prod.sh: VPS1 pull + up --no-build (antigo vira deploy-prod-legado-webhook.sh)
- /api/health usa APP_VERSION (tag) com fallback version.txt; badge no canto
- webhook 9003 aposentado (gatilho agora e CI/tag)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose-dev.yml

@@ -1,10 +1,11 @@
 version: '3.8'
 
+# DEV do rx (VPS4). Antes usava network_mode:host, que no Docker rootless não expõe na
+# rede real → Traefik (VPS1) não alcançava o vite → 502. Agora: bridge + porta publicada.
 services:
   dev-api:
     image: node:20
     container_name: rx_dev_api
-    network_mode: "host"
     working_dir: /app
     volumes:
       - ./dental-server:/app
@@ -13,16 +14,25 @@ services:
       sh -c "npm install && npm run dev"
     env_file:
       - ./dental-server/.env
+    networks:
+      - rxdev
     restart: unless-stopped
 
   dev-client:
     image: node:20
     container_name: rx_dev_client
-    network_mode: "host"
     working_dir: /app
     volumes:
       - ./dental-server/dental-client:/app
       - /app/node_modules
     command: >
       sh -c "npm install && npx vite --host 0.0.0.0 --port 5173"
+    ports:
+      - "5173:5173"          # publicado na VPS4 → alvo do Traefik (dev.rx → 10.99.0.4:5173)
+    networks:
+      - rxdev                # mesma rede do api → o proxy do vite alcança rx_dev_api:3000
     restart: unless-stopped
+
+networks:
+  rxdev:
+    driver: bridge