feat(deploy): add verified image deployments with consistent backups

deploy/compose.image.yml

@@ -0,0 +1,15 @@
+# Copy this file to the instance directory; use a private .env beside it.
+name: ${RAWMARK_PROJECT:?Set RAWMARK_PROJECT}
+services:
+  rawmark:
+    image: ${RAWMARK_IMAGE:?Set a verified registry image digest}
+    ports:
+      - "${RAWMARK_BIND:-127.0.0.1}:${RAWMARK_PORT:?Set RAWMARK_PORT}:8080"
+    volumes:
+      - type: bind
+        source: ${RAWMARK_DATA_DIR:?Set the absolute persistent data directory}
+        target: /data
+        bind:
+          create_host_path: false
+    restart: unless-stopped
+    stop_grace_period: 15s