feat(deploy): staging/production Docker deploy for Payload (MITHOME-97)

Fixes a real, previously-undiscovered build failure and a bigger
architectural gap found while testing an actual `docker build` of
proto/Dockerfile for the first time since the Payload migration:

1. Docker build failure: the (frontend)/[locale] pages use
   generateStaticParams, so `next build` fully prerenders them (SSG) —
   which calls the Payload Local API during the build. With no
   MONGODB_URI/PAYLOAD_SECRET reachable in the build stage, `docker
   build` failed outright ("missing secret key").

2. Bigger problem underneath: even if the build could reach a DB,
   full SSG means a Payload admin edit would NOT appear on the public
   site until a full rebuild + redeploy — directly undermining the
   project's whole reason for migrating to Payload (self-service
   content editing for the client).

Fix (user-confirmed direction: force-dynamic): dropped
generateStaticParams from (frontend)/[locale]/layout.tsx and
[locale]/[slug]/page.tsx, added `export const dynamic = 'force-dynamic'`
to layout.tsx + both page.tsx files. Every request now reads Payload
live — publishing in the admin is visible immediately, and the Docker
build no longer needs any DB connectivity at all (verified: a full
`docker build --target builder` now succeeds with zero env vars set).

Docker/Compose changes:
- docker-compose.staging.yml / docker-compose.prod.yml: wired
  PAYLOAD_SECRET through to the app container (was documented in
  .env.*.example since MITHOME-86 but never actually passed to the
  container — Payload would have refused to start). No fallback,
  same fail-loudly pattern as MONGODB_URI.
- Same two files: added a named `media_data_{staging,prod}` volume
  mounted at /app/media — Payload's local upload storage (Media.ts)
  writes there at the container's runtime cwd; without a volume,
  `deploy.sh`'s `--force-recreate` would silently wipe every uploaded
  logo/image on each deploy.
- docker-compose.dev.yml: was missing PAYLOAD_SECRET entirely (only
  discovered because the same "missing secret key" error reproduces
  there too) — added a dev-only literal value. Media persistence
  already works there via the existing `./proto:/app` bind mount, no
  volume needed. Also dropped the obsolete `version: '3.8'` key
  (compose warns it's ignored).
- DOCKER.md: one-paragraph note on the new PAYLOAD_SECRET requirement
  and where the admin account gets created.

Verified:
- `docker build --target builder` succeeds from a clean context with
  zero environment variables (previously failed).
- `docker build --target runner` + `docker run` against the real dev
  MongoDB (PAYLOAD_SECRET + MONGODB_URI supplied at runtime only):
  /hu, /admin and /api/health all return 200 inside the container;
  confirmed live in the browser that Payload content renders
  correctly end-to-end through the production Next.js server, not
  just `next dev`.
- `docker compose -f docker-compose.{staging,prod,dev}.yml config`
  parses cleanly.
- Full gate green: tsc, lint, proto unit tests (51 passed),
  scripts/pre-deploy-tests.sh (proto tests, tsc, lint, content schema,
  plane-sync — all pass).

deploy.sh itself needs no changes: it already just runs
`docker compose up --build`, and that now works without any
build-time DB wiring.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.staging.yml

@@ -18,11 +18,20 @@ services:
       # unauthenticated default URI would silently break the app — fail loudly instead.
       - MONGODB_URI=${MONGODB_URI}
       - MONGODB_DB=${MONGODB_DB:-mozdit}
+      # No fallback either (MITHOME-97): Payload refuses to start without a real
+      # secret ("missing secret key"), which is exactly what we want here.
+      - PAYLOAD_SECRET=${PAYLOAD_SECRET}
       - NEXT_PUBLIC_SITE_URL=${NEXT_PUBLIC_SITE_URL:-https://stage.mozdit.hu}
       - NEXT_PUBLIC_DEPLOY_ENV=staging
       - NEXT_PUBLIC_COMPANY_NAME=${NEXT_PUBLIC_COMPANY_NAME:-mozdIT Bt.}
       - NEXT_PUBLIC_CONTACT_EMAIL=${NEXT_PUBLIC_CONTACT_EMAIL:-info@mozdit.hu}
       - LOKI_HOST=${LOKI_HOST:-http://loki:3100}
+    volumes:
+      # Payload helyi upload storage (proto/src/collections/Media.ts) — futásidőben
+      # a konténer WORKDIR-je (/app) alatti media/ mappába ír. Named volume nélkül
+      # a `deploy.sh` minden újratelepítéskor (--force-recreate) elveszítené a
+      # korábban feltöltött logókat/képeket (MITHOME-97).
+      - media_data_staging:/app/media
     depends_on:
       - mongodb
     networks:
@@ -54,6 +63,8 @@ services:
 volumes:
   mongodb_data_staging:
     driver: local
+  media_data_staging:
+    driver: local
 
 networks:
   mozdit-network-staging: