feat(meditate,deploy): Meditate beside the instance, and every server's public address from .env

Meditate's deploy step (ADR 0038, step 7; ADR 0039, D14), as Todo's: the
server's Dockerfile with the library's check compiled beside it, its
production config on its own database and role, compose.meditate.yaml as a
member of the register, its site sending /library/* to the web server and
the rest to the API server, the operator's library read-only in a compose
file of its own, and redeploy.sh, backup.sh and the image replay taking it
in.

Every server's public address now comes from .env (Serverpod's
SERVERPOD_API_SERVER_PUBLIC_HOST and _WEB_SERVER_, which win over the
config file): Train, Todo and Meditate from their domains, Learn from
LEARN_PUBLIC_HOST, unset learn.halkyon.eu as before. Without it a server on
halkyon.li would name halkyon.eu in its SimpleLogin callback, profile pages
and privacy page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/compose.meditate.yaml

@@ -0,0 +1,60 @@
+# Halkyon Meditate's server beside the instance (ADR 0038, step 7; ADR 0039, D14).
+# Switched on in .env, with Meditate's domain and secrets:
+#
+#   COMPOSE_FILE=compose.learn.yaml:compose.meditate.yaml
+#   MEDITATE_DOMAIN=meditate.halkyon.li
+#
+# Meditate is a member of the instance's register, which Learn's server holds (ADR
+# 0016), as Todo is: one account a person, signing in through the register, the shared
+# INSTANCE_SECRET on every call between them, which reach each other on the instance's
+# own networks alone. Its database is `halkyon_meditate` in the instance's PostgreSQL,
+# under a role of its own that can't connect to the other apps'. Its server reads no
+# sitting and no dream: every row is sealed on the person's devices (ADR 0038, D7). The
+# operator's library (D16) is a file of its own, compose.meditate-library.yaml; without
+# it Meditate has none. Setting it up: sidecars/README.md, Meditate.
+
+services:
+  meditate-server:
+    build:
+      context: ..
+      dockerfile: apps/meditate/halkyon_meditate_server/Dockerfile
+    image: halkyon-meditate-server
+    restart: unless-stopped
+    # As Learn's: migrations at every start (redeploy.sh has applied them before).
+    command: ["--apply-migrations"]
+    environment:
+      SERVERPOD_DATABASE_PASSWORD: ${MEDITATE_POSTGRES_PASSWORD:?set MEDITATE_POSTGRES_PASSWORD in deploy/.env}
+      SERVERPOD_PASSWORD_serverSideSessionKeyHashPepper: ${MEDITATE_SESSION_KEY_HASH_PEPPER:?set MEDITATE_SESSION_KEY_HASH_PEPPER in deploy/.env}
+      # Its public address, which config/production.yaml names otherwise: the
+      # instance's own domain.
+      SERVERPOD_API_SERVER_PUBLIC_HOST: ${MEDITATE_DOMAIN:?set MEDITATE_DOMAIN in deploy/.env}
+      SERVERPOD_WEB_SERVER_PUBLIC_HOST: ${MEDITATE_DOMAIN:?set MEDITATE_DOMAIN in deploy/.env}
+      # The register (ADR 0016): Learn's web server, on the instance's own network,
+      # and the secret every call between them carries.
+      ACCOUNT_REGISTER_URL: http://server:8082/
+      SERVERPOD_PASSWORD_instanceSecret: ${INSTANCE_SECRET:?set INSTANCE_SECRET in deploy/.env}
+      # Caddy, as for Learn's server (compose.learn.yaml).
+      TRUSTED_PROXIES: 172.30.80.2 fd4a:6c6b:7e80::2
+      SOURCE_URL: ${SOURCE_URL:-}
+      DATA_LOCATION: ${DATA_LOCATION:-}
+      BACKUP_LOCATION: ${BACKUP_LOCATION:-}
+    networks:
+      - default
+      - edge
+    depends_on:
+      postgres:
+        condition: service_healthy
+    logging:
+      driver: journald
+
+  caddy:
+    environment:
+      MEDITATE_DOMAIN: ${MEDITATE_DOMAIN:?set MEDITATE_DOMAIN in deploy/.env}
+    volumes:
+      - ./sidecars/meditate.caddy:/etc/caddy/sidecars/meditate.caddy:ro
+
+  server:
+    environment:
+      # Meditate's web server, told when an account goes (ADR 0016), beside the members
+      # the other compose files and INSTANCE_MEMBERS name.
+      INSTANCE_MEMBER_MEDITATE: http://meditate-server:8082/