fix(deploy): apparmor:unconfined for Docker-in-LXC

The docker-default AppArmor profile can't be loaded from inside the LXC; match the
lab convention (finance/arr stacks) of running services unconfined.

docker-compose.localdev.yml

@@ -25,6 +25,9 @@ services:
     environment:
       # Exactly one scheduler may write to the shared DB; the server owns it.
       SCHEDULER_ENABLED: "false"
+    # Harmless on Docker Desktop; needed if ever run under Docker-in-LXC.
+    security_opt:
+      - apparmor:unconfined
     ports:
       - "${APP_PORT:-8080}:8000"
     restart: unless-stopped

docker-compose.server.yml

@@ -26,6 +26,10 @@ services:
     ports:
       # Published on the LAN so the local dev webapp uses this central DB.
       - "5432:5432"
+    # Required for Docker-in-LXC: the container can't load the docker-default
+    # AppArmor profile inside an unprivileged-from-AppArmor's-view namespace.
+    security_opt:
+      - apparmor:unconfined
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-subfeed} -d ${POSTGRES_DB:-subfeed}"]
       interval: 5s
@@ -45,6 +49,8 @@ services:
     depends_on:
       db:
         condition: service_healthy
+    security_opt:
+      - apparmor:unconfined
     ports:
       # Exposed on the LAN for status/health checks only. Interactive Google login
       # needs a public HTTPS redirect URL (set up later); backfill runs regardless.