chore: add deployment docs, model script, and finalize env config

Phase 6 deployment infrastructure: finalize Dockerfile with OCI labels,
improve .env.example with grouped config keys, add scripts/pull-models.sh
for Mac-side model setup, and add docs/deploy.md covering the full
deployment topology, prerequisites, security model, and troubleshooting.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -6,6 +6,8 @@ COPY . .
 RUN CGO_ENABLED=0 go build -o /out/foreman ./cmd/foreman
 
 FROM gcr.io/distroless/static-debian12
+LABEL org.opencontainers.image.source="https://gitea.stevedudenhoeffer.com/steve/foreman"
+LABEL org.opencontainers.image.description="Queued Ollama proxy daemon"
 COPY --from=build /out/foreman /foreman
 EXPOSE 8080
 ENTRYPOINT ["/foreman", "serve"]