Run the GNSS simulator in production too

Adds a gnss-simulator service to docker-compose.yaml, sharing
maptool's network namespace (network_mode: "service:maptool") so it's
reachable at the 127.0.0.1:2947 GpsdClient hardcodes -- there's no
real receiver attached to the server, so without this the "GNSS"
control there always shows "no fix". Both services now reference the
same image (maptool:latest) explicitly rather than each service with
its own `build: .` producing two separately-tagged (if
identically-layered) images.

Verified for real: built and ran the full compose stack in an
isolated project/port on cube (not the live one), confirmed
/api/gnss/position reports a moving fix across two polls through the
actual sidecar networking, then tore it down completely -- containers,
image, network, temp checkout. Production's own stack was untouched
throughout and confirmed still healthy afterward.

docs/deployment.adoc

@@ -107,6 +107,18 @@ id/secret to store as the two `OAUTH_CLIENT_*` secrets above.
 usernames, e.g. `randy,friend1,friend2` — not their emails, the
 `login` field from Gitea's `/api/v1/user`.
 
+== GNSS simulator
+
+`docker-compose.yaml`'s `gnss-simulator` service (`bin/gnss_simulator.rb`,
+also documented for local dev in `docs/development.adoc`) runs
+alongside `maptool` in production too, sharing its network namespace
+(`network_mode: "service:maptool"`) so it's reachable at the
+hardcoded `127.0.0.1:2947` `Maptool::GpsdClient` expects — there's no
+real GNSS receiver attached to the server, so without this the "GNSS"
+control would just always show "no fix". It drives a loop around
+Bratislava; remove the service block (nothing else needs to change)
+whenever a real receiver/gpsd setup replaces it.
+
 == Garmin LiveTrack session webhook
 
 `POST /api/livetrack/session` (`session_id`, `session_token`, `secret` form