feat: add container manager CLI commands and docker-compose overlay for admin container lifecycle

devplacepy/templates/docs/production-deploy.html

@@ -33,10 +33,13 @@ Operational behavior (rate limits, registration, maintenance mode, upload size,
 
 ```bash
 cp .env.example .env        # set SECRET_KEY, PORT, DEVPLACE_SITE_URL
-make docker-up              # docker compose up -d (builds on first run)
+make docker-build           # build the image (installs the docker CLI)
+make docker-up              # start (creates ./var, mounts the socket)
 ```
 
-Open `http://<host>:<PORT>`. Useful targets: `make docker-logs` (tail), `make docker-down` (stop), `make docker-build` (rebuild image), `make docker-clean` (down).
+Open `http://<host>:<PORT>`. Useful targets: `make docker-logs` (tail), `make docker-down` (stop), `make docker-clean` (down).
+
+The make targets always apply the `docker-compose.containers.yml` overlay, so the admin-only Container Manager works with no extra setup. Always update through the make targets - a plain `docker compose up -d` drops the overlay and silently removes the docker socket and CLI the manager needs.
 
 ## Updating
 
@@ -44,13 +47,13 @@ Code is bind-mounted, so most updates need no rebuild:
 
 ```bash
 git pull
-docker compose up -d            # restart workers on the new code
+make docker-up                  # restart workers on the new code
 ```
 
 Rebuild the image only when dependencies change:
 
 ```bash
-docker compose build && docker compose up -d
+make docker-build && make docker-up
 ```
 
 ## Release branch
@@ -69,7 +72,7 @@ Because the container runs host source, rolling back is a git operation:
 
 ```bash
 git checkout <previous-good-commit>
-docker compose up -d
+make docker-up
 ```
 
 Back up `devplace.db` (and its `-wal`/`-shm`) before a risky change; the schema auto-syncs forward but is not auto-downgraded.