build(todo): Todo deployable beside Learn's server, and released as an APK, on F-Droid and as a snap (ADR 0033, step 5)

deploy/compose.todo.yaml adds Todo's server at todo.halkyon.eu, a member
of Learn's register, its database halkyon_todo in the instance's
PostgreSQL, its image built as Train's. redeploy.sh and backup.sh go over
every app server .env switches on (train, todo). Each compose file names
its server to the register in a variable of its own
(INSTANCE_MEMBER_TRAIN, INSTANCE_MEMBER_TODO), which halkyon_base adds to
INSTANCE_MEMBERS, each address once, as a second compose file's default
would have replaced Train's.

apps/todo/release.dart configures the release tool for Todo's APK and
snap: a key of its own (pinned once made; until then nothing is
released), the F-Droid listing (Time, NonFreeNet), and the snap from
apps/todo/snap/, which the tool builds in a clone of the repository at the
tag with that folder in place of snap/, as snapcraft builds one recipe a
folder and the root's is Learn's. What's new for 0.1.0 in English and
German, now shown. Android's backup and transfer are off, as Train's
(D53): the reminders scheduled keep their tasks' titles unsealed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/compose.todo.yaml

@@ -0,0 +1,55 @@
+# Halkyon Todo's server beside the instance (ADR 0033, step 5). Switched on in .env,
+# with Todo's domain and secrets:
+#
+#   COMPOSE_FILE=compose.yaml:compose.todo.yaml
+#   TODO_DOMAIN=todo.halkyon.eu
+#
+# Todo is a member of the instance's register, which Learn's server holds (ADR 0016),
+# as Train is: one account a person, signing in through the register, the shared
+# INSTANCE_SECRET on every call between them, which reach each other on the instance's
+# own networks alone. Its database is `halkyon_todo` in the instance's PostgreSQL, under
+# a role of its own that can't connect to Learn's or Train's. Its server reads no task:
+# every row is sealed on the person's devices (ADR 0033, D5). Setting it up:
+# sidecars/README.md, Todo.
+
+services:
+  todo-server:
+    build:
+      context: ..
+      dockerfile: apps/todo/halkyon_todo_server/Dockerfile
+    image: halkyon-todo-server
+    restart: unless-stopped
+    # As Learn's: migrations at every start (redeploy.sh has applied them before).
+    command: ["--apply-migrations"]
+    environment:
+      SERVERPOD_DATABASE_PASSWORD: ${TODO_POSTGRES_PASSWORD:?set TODO_POSTGRES_PASSWORD in deploy/.env}
+      SERVERPOD_PASSWORD_serverSideSessionKeyHashPepper: ${TODO_SESSION_KEY_HASH_PEPPER:?set TODO_SESSION_KEY_HASH_PEPPER in deploy/.env}
+      # The register (ADR 0016): Learn's web server, on the instance's own network,
+      # and the secret every call between them carries.
+      ACCOUNT_REGISTER_URL: http://server:8082/
+      SERVERPOD_PASSWORD_instanceSecret: ${INSTANCE_SECRET:?set INSTANCE_SECRET in deploy/.env}
+      # Caddy, as for Learn's server (compose.yaml).
+      TRUSTED_PROXIES: 172.30.80.2 fd4a:6c6b:7e80::2
+      SOURCE_URL: ${SOURCE_URL:-}
+      DATA_LOCATION: ${DATA_LOCATION:-}
+      BACKUP_LOCATION: ${BACKUP_LOCATION:-}
+    networks:
+      - default
+      - edge
+    depends_on:
+      postgres:
+        condition: service_healthy
+    logging:
+      driver: journald
+
+  caddy:
+    environment:
+      TODO_DOMAIN: ${TODO_DOMAIN:?set TODO_DOMAIN in deploy/.env}
+    volumes:
+      - ./sidecars/todo.caddy:/etc/caddy/sidecars/todo.caddy:ro
+
+  server:
+    environment:
+      # Todo's web server, told when an account goes (ADR 0016), beside the members
+      # the other compose files and INSTANCE_MEMBERS name.
+      INSTANCE_MEMBER_TODO: http://todo-server:8082/