split Deploy into a hub + 3 sub-pages; inline comments over annotations

The Deploy page got long and the code annotations rendered inconsistently
(some as (n) numbers, some as clickable +, and a marker on a fully-commented
line made that line vanish). Fix both:

- Deploy is now a HUB (docs/deploy/index.md): the intro + collision rule +
  central-deploy note, then card links to three focused sub-pages. Deploy
  stays the single global-nav entry; sub-pages are not_in_nav, reached from
  the hub cards.
  - deploy/compose.md — compose convention, storage tiers, how deploy fills
    it in, subprocess/browser knobs, checklist
  - deploy/dockerfile.md — services-account image, COPY, layer caching, uv
  - deploy/secrets.md — keeping secrets out of the image
- Replace code annotations with INLINE COMMENTS on the compose/Dockerfile
  examples: everything visible at once, no + to click, and the commented
  MOUNTS_DIR line no longer disappears.
- Update inbound links (index card, standards, workflow, environments) to
  deploy/ and deploy/compose.md; nav Deploy -> deploy/index.md with
  not_in_nav for the sub-pages.

Verified in-browser: hub cards link correctly, sub-pages render with visible
inline comments (0 annotation markers), left nav shows only Deploy;
mkdocs build --strict clean (validates not_in_nav + all cross-links).

Signed-off-by: disqualifier <dev@disqualifier.me>

docs/deploy/secrets.md

@@ -0,0 +1,19 @@
+# Secrets
+
+!!! warning "Secrets never go in the image"
+    We do **not** commit secrets (usually, lol). They stay **gitignored** and live on
+    the host in your config dir, reaching your container read-only via `${CONFIG_DIR}`.
+    Add them to `.dockerignore` so a `COPY . .` can't sweep them into a layer.
+
+## How it works
+
+- Secrets live on the **host**, in your config dir — never in git, never in the image.
+- They reach the container **read-only** via the injected `${CONFIG_DIR}` mount (see
+  **[Compose convention](compose.md)**).
+- Keep them out of the build context: list them in `.dockerignore` so a blanket
+  `COPY . .` can't pull them into a layer.
+
+## Rotating a secret
+
+A host-side edit — update the file and the service picks it up on restart. No rebuild,
+and nothing you run: flag it and we handle the restart.