fix(ci): bouw met productie-.env, deploy met env+volumes en rollback

- Deploy kopieert de productie-.env van de host in de build-context:
  Next.js bakt NEXT_PUBLIC_* in en valideert DATABASE_URL/HOTEL_NAME
  (SKIP_ENV_VALIDATION is verboden voor productie, zie src/env.ts).
- Dockerfile builder installeert git (next.config.ts deploymentId).
- Deploy-container krijgt --env-file + dezelfde volumes als compose,
  stopt ook de oude compose-container (poort 3002) en rolt terug via
  compose bij een falende health check.

Dockerfile

@@ -8,6 +8,12 @@
 # --- Builder stage ---
 FROM node:26.8.1-bookworm-slim AS builder
 
+# git is needed by next.config.ts (git rev-parse for deploymentId) and
+# ca-certificates by package registries. Build runs on host network (see
+# compose: iptables is disabled), so apt has registry access here.
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
 # Install all three package managers so the build can pick whichever lockfile exists.
 RUN npm install -g [email protected] yarn