Sync compose with VPS deployment and trigger Watchtower on image push

The deployed compose (SELinux :Z, TZ, healthcheck, watchtower label) now
lives in the repo as the source of truth, and CI asks the VPS Watchtower
API to deploy immediately after pushing instead of waiting for the
nightly sweep.

docker/compose.yml

@@ -1,18 +1,20 @@
+# Deployed copy lives at junior.gib:~/Server/Agentchat/compose.yml — keep in sync.
 networks:
   nginx-bridge:
-    external: true
+    external: true            # ALWAYS external; see the VPS ~/Server/AGENTS.md §5
 
 services:
   agentchat:
-    image: git.gbrown.org/gib/agentchat:${TAG:-latest}
-    container_name: ${CONTAINER_NAME:-agentchat}
-    hostname: ${CONTAINER_NAME:-agentchat}
-    domainname: ${DOMAIN:-agentchat.gbrown.org}
-    networks: ['${NETWORK:-nginx-bridge}']
-    #ports: ['${PORT:-8080}:8080']
+    image: git.gbrown.org/gib/agentchat:latest
+    container_name: agentchat
+    hostname: agentchat
+    domainname: agentchat.gbrown.org
+    networks: ['nginx-bridge']
     environment:
+      - TZ=America/New_York
       - AGENTCHAT_DB=/data/agentchat.db
-    volumes: ['./data:/data']
+    volumes:
+      - ./data:/data:Z        # :Z mandatory under SELinux Enforcing; see AGENTS.md §6
     labels: ['com.centurylinklabs.watchtower.enable=true']
     restart: unless-stopped
     healthcheck: