Split deploy into independent poller and web stacks

Decouple the privileged hardware poller from web iterations so a web
redeploy can never recreate/restart the poller (the backplane-touching
container). Two images from one Dockerfile via build targets:

- jbod-poller: privileged producer, ships smartmontools/sg3-utils/ledmon,
  Redis-only deps (~197MB)
- jbod-web: unprivileged read-only consumer (REST/UI/MQTT), no hardware
  tools, no /dev (~147MB)

Two compose projects sharing Redis over host networking:
- compose.infra.yml (jbod-infra): poller + redis — stable substrate
- compose.web.yml   (jbod-web):   app — 'up -d --build' touches only app

build.sh builds/pushes both images; split requirements-{poller,web}.txt;
dropped the combined docker-compose.yml; .dockerignore excludes tmp/ (keeps
the venv and the mqtt.env creds out of the build context).

build.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-IMAGE="docker.adamksmith.xyz/jbod-monitor"
+REG="docker.adamksmith.xyz"
 
 cd "$(dirname "$0")"
 
@@ -10,16 +10,21 @@ git add -A
 if git diff --cached --quiet; then
     echo "No changes to commit, using HEAD"
 else
-    git commit -m "${1:-Build and push image}"
+    git commit -m "${1:-Build and push images}"
 fi
 
 SHA=$(git rev-parse --short HEAD)
 
-echo "Building ${IMAGE}:${SHA}"
-docker build -t "${IMAGE}:${SHA}" -t "${IMAGE}:latest" .
+# Two images from one Dockerfile (shared frontend build stage is cached):
+#   jbod-poller — privileged hardware producer
+#   jbod-web    — unprivileged read-only consumer (REST/UI/MQTT)
+for target in poller web; do
+    img="${REG}/jbod-${target}"
+    echo "Building ${img}:${SHA}"
+    docker build --target "${target}" -t "${img}:${SHA}" -t "${img}:latest" .
+    echo "Pushing ${img}:${SHA}"
+    docker push "${img}:${SHA}"
+    docker push "${img}:latest"
+done
 
-echo "Pushing ${IMAGE}:${SHA}"
-docker push "${IMAGE}:${SHA}"
-docker push "${IMAGE}:latest"
-
-echo "Done: ${IMAGE}:${SHA}"
+echo "Done: ${REG}/jbod-{poller,web}:${SHA}"