Split deploy into independent poller and web stacks

Decouple the privileged hardware poller from web iterations so a web
redeploy can never recreate/restart the poller (the backplane-touching
container). Two images from one Dockerfile via build targets:

- jbod-poller: privileged producer, ships smartmontools/sg3-utils/ledmon,
  Redis-only deps (~197MB)
- jbod-web: unprivileged read-only consumer (REST/UI/MQTT), no hardware
  tools, no /dev (~147MB)

Two compose projects sharing Redis over host networking:
- compose.infra.yml (jbod-infra): poller + redis — stable substrate
- compose.web.yml   (jbod-web):   app — 'up -d --build' touches only app

build.sh builds/pushes both images; split requirements-{poller,web}.txt;
dropped the combined docker-compose.yml; .dockerignore excludes tmp/ (keeps
the venv and the mqtt.env creds out of the build context).

compose.infra.yml

@@ -0,0 +1,47 @@
+# Infra stack: the hardware poller + Redis. This is the STABLE substrate —
+# deploy once, pin to a known-good image SHA, and touch it deliberately
+# (never as part of a web iteration). Web redeploys use compose.web.yml and
+# can never name these services.
+#
+#   docker compose -f compose.infra.yml up -d      # bring up / update poller+redis
+#
+name: jbod-infra
+
+services:
+  poller:
+    image: docker.adamksmith.xyz/jbod-poller:latest   # pin to a SHA in deploy
+    container_name: jbod-poller
+    restart: unless-stopped
+    privileged: true
+    pid: host
+    network_mode: host
+    volumes:
+      - /dev:/dev
+      - /sys:/sys:ro
+      - /run/udev:/run/udev:ro
+    environment:
+      - TZ=America/Denver
+      - ZFS_USE_NSENTER=true
+      - REDIS_HOST=127.0.0.1
+      - REDIS_PORT=6379
+      - REDIS_DB=0
+      # Pacing — keep the SAS bus quiet. POLL_CONCURRENCY=1 fully serializes.
+      - POLL_SWEEP_INTERVAL=300
+      - POLL_DRIVE_GAP=0.5
+      - POLL_CONCURRENCY=1
+      - POLL_STARTUP_JITTER=10
+      - POLL_DATA_TTL=900
+    depends_on:
+      - redis
+
+  redis:
+    image: redis:7-alpine
+    container_name: jbod-redis
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - redis-data:/data
+    command: redis-server --save 60 1 --loglevel warning
+
+volumes:
+  redis-data: