ops(docker): prune unused cache on deploys and nightly

Add scripts/docker-prune.sh (build cache >72h capped at 4g, unreferenced images >7d, stopped containers >24h; never volumes), run it after every CI deploy and compose update, and schedule a nightly prune from the host-side jobs-worker. Tighten the deployment contract tests to assert the scoped-prune boundaries.

src/lib/deploy-workflow-contract.test.ts

@@ -26,10 +26,18 @@ it("preserves production runtime configuration and recent cache", () => {
 	expect(deploy).toContain("/var/www/Gamedata:/var/www/Gamedata");
 	expect(deploy).toContain("/app/storage");
 	expect(deploy).not.toContain("--env-file");
-	expect(deploy).toContain(
+	// The scoped prune lives in docker-prune.sh; deploys invoke it for both CI
+	// and scheduled updates. It reclaims build cache + old unreferenced images
+	// but never touches volumes.
+	expect(deploy).toContain("bash \"$deploy_dir/scripts/docker-prune.sh\"");
+	const prune = readFileSync("scripts/docker-prune.sh", "utf8");
+	expect(prune).toContain(
 		'docker builder prune -af --filter "until=72h" --max-used-space=4g',
 	);
+	expect(prune).toContain('docker image prune -af --filter "until=168h"');
+	expect(prune).toContain('docker container prune -f --filter "until=24h"');
 	expect(deploy).not.toContain("docker volume prune");
+	expect(prune).not.toContain("docker volume prune");
 });
 it("builds the checked out source without fetching a moving remote branch", () => {
 	const dockerfile = readFileSync("Dockerfile", "utf8");