hotfix: pin docker-compose to GHCR :1.4.0 to restore production (#150)

Production at healthlog.bombeck.io is returning 503 from Traefik
("no available server") since the v1.4.1 deploys started landing on
apps-01. The container boots — Next.js prints "Ready" and the
pg-boss background workers run — but never accepts HTTP on :3000,
so the Docker healthcheck (`wget --spider /api/version`) fails and
Traefik takes the upstream out of rotation.

Locally the v1.4.1 source passes typecheck, all 669 unit tests, and
the 10-test integration suite. The runtime regression only surfaces
in the Coolify-built image. Suspected cause: a layer-cache corruption
left over from the failed PR #146 deploy at 14:08 (which OOM-killed
during the builder COPY step), or a build interaction between the
new dev-deps (@playwright/test, @axe-core/playwright, testcontainers)
and Next.js standalone bundling. A `force: true` rebuild via Coolify
did not resolve it, which suggests it's not just stale cache.

This commit removes the `build:` block from the app service and
pins the image to the v1.4.0 GHCR tag — the last release verified
healthy on production. Coolify will pull the multi-arch image and
run it directly. Site comes back up immediately.

The v1.4.1 fixes are NOT lost — the source still ships in main, the
GHCR :1.4.1 image was built successfully by the docker-publish
workflow, and we re-pin once the runtime regression is reproduced
locally and fixed.

Self-hosters who want to keep building from source can add a
docker-compose.override.yml with the `build:` block. The compose
override pattern is documented and stable.

No DB migration. No env-var change.

docker-compose.yml

@@ -4,10 +4,16 @@ services:
   # For horizontal scaling switch to the web/worker split below
   # (HEALTHLOG_PROCESS_TYPE=web on this service + uncomment app-worker).
   app:
-    image: ghcr.io/mbombeck/healthlog:latest
-    build:
-      context: .
-      dockerfile: Dockerfile
+    # HOTFIX: pinned to the v1.4.0 GHCR multi-arch image (linux/amd64 +
+    # linux/arm64) while a runtime regression introduced in the v1.4.1
+    # source build is investigated. The locally-built image from main
+    # HEAD currently produces a container that boots Next.js + the
+    # background workers but never accepts HTTP on :3000, so the
+    # Docker healthcheck fails and Traefik returns 503. v1.4.0 is the
+    # last release verified healthy on production. Self-hosters who
+    # want to build from source can re-add the `build:` block locally
+    # via a docker-compose.override.yml.
+    image: ghcr.io/mbombeck/healthlog:1.4.0
     container_name: healthlog-app
     ports:
       - "3000:3000"