fix(compose): keep the CMS opt-in so it cannot claim the CI port

On a CI-managed host scripts/ci-deploy.sh owns port 3002 through the
blue/green slots, so a compose replica of the cms service could only ever
crash-loop on EADDRINUSE — it never serves traffic, because nginx points at a
slot container. Gate the service behind the `cms` profile so a bare
`docker compose up -d` starts only byparr. Naming the service explicitly
(`docker compose up -d cms`, which is what the installer and updater already
do) still enables the profile automatically, so the compose-only install path
keeps working.

Keep the one port that is actually served (3002) and make the 2 GB ceiling
hard by capping swap at 2g as well. Drop the green compose service (3003):
the green slot only ever exists as a docker run container created by CI, so
compose no longer defines it and the two paths cannot drift apart.

The loopback override contract stays covered: proxy-config.test.mjs now
renders the configuration with --profile cms, and a new build-contract test
pins the profile and the memory limits so neither can be dropped by accident.

src/lib/docker-build-contract.test.ts

@@ -47,6 +47,17 @@ it("passes a compiled release to both the application build and final image", ()
 	expect(compose).toContain("NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}");
 });
 
+it("keeps the compose CMS opt-in and inside the 2 GB limit", () => {
+	const compose = readFileSync("docker-compose.yml", "utf8");
+	// A bare `docker compose up -d` starts only byparr. On a CI-managed host the
+	// CMS owns port 3002 through ci-deploy.sh; letting compose claim the same
+	// port again produces an endless EADDRINUSE crash loop.
+	expect(compose).toContain('profiles: ["cms"]');
+	expect(compose).not.toContain("cms-green");
+	expect(compose).toContain("mem_limit: 2g");
+	expect(compose).toContain("memswap_limit: 2g");
+});
+
 it("builds with fixtures and excludes installation secrets from every stage", () => {
 	const ignored = readFileSync(".dockerignore", "utf8");
 	expect(ignored).toMatch(/^\.env$/m);