fix(deploy): apparmor:unconfined for Docker-in-LXC

The docker-default AppArmor profile can't be loaded from inside the LXC; match the
lab convention (finance/arr stacks) of running services unconfined.

docker-compose.localdev.yml

@@ -25,6 +25,9 @@ services:
     environment:
       # Exactly one scheduler may write to the shared DB; the server owns it.
       SCHEDULER_ENABLED: "false"
+    # Harmless on Docker Desktop; needed if ever run under Docker-in-LXC.
+    security_opt:
+      - apparmor:unconfined
     ports:
       - "${APP_PORT:-8080}:8000"
     restart: unless-stopped