Tidy the deploy checkout into build/, symlink docker-compose.yaml up

Sources now sync into /srv/podman/maptool/build/ (wiped and fully
replaced every deploy, nothing in it needs preserving) instead of
directly into /srv/podman/maptool/ itself, where data/ and .env also
live — the old sync step had to specifically skip data/ by name to
avoid wiping it; this way there's nothing to skip.

docker-compose.yaml is symlinked (ln -sf, relative target) from
/srv/podman/maptool/ up to build/ — both for a human to still find it
at the top, and because that symlink's own location, not build/, is
what compose resolves ./data and .env's directory against. No changes
to docker-compose.yaml or the podman-compose@.service systemd unit's
WorkingDirectory needed.

Verified against a full local dry run of the new sync step (copy into
a fake build/, symlink up, confirm pre-existing data/ survives) and
`docker-compose config` against the real docker-compose.yaml through
that symlink — both volume mounts (./data, the kiwix ZIM path)
resolved to the sibling data/ directory as intended, not build/data.

docs/deployment.adoc

@@ -31,15 +31,30 @@ existing paths/tooling that still assume `/srv/docker` keep working;
 expect this to flip the other way, `/srv/docker` symlinked to
 `/srv/podman`, once nothing depends on the old name anymore) holds:
 
-* A checkout of this repository (kept in sync by the deploy job, see
-  below) — `Dockerfile`, `docker-compose.yaml`, application code.
-  `podman compose` reads the same `docker-compose.yaml` — no
-  Podman-specific compose file needed.
-* `data/`, *not* part of that sync — uploaded GPX files,
-  `offline.pmtiles`, `terrain.pmtiles`, and `kiwix/wikipedia.zim` (see
-  `docs/development.adoc` for each). Persisted via a bind mount
-  (`./data:/app/data` in `docker-compose.yaml`), so a redeploy never
-  touches it.
+* `build/` — a checkout of this repository (kept in sync by the
+  deploy job, see below), wiped and fully replaced every deploy —
+  `Dockerfile`, `docker-compose.yaml`, application code.
+* `docker-compose.yaml` — a relative symlink to `build/docker-compose.yaml`,
+  purely so it's where a human poking around expects to find it, at
+  the top rather than a level down. Also what makes the layout work at
+  all: `podman compose`/`docker compose` resolve a relative volume
+  path (`./data` below) against the *symlink's own* directory, not
+  where it points — confirmed against plain `docker-compose config`,
+  not assumed — so `./data:/app/data` in the compose file keeps
+  meaning `/srv/podman/maptool/data`, and
+  `podman-compose@.service`'s `WorkingDirectory=/srv/podman/maptool`
+  needs no change either.
+* `data/`, *not* part of the checkout sync (nothing in `build/`
+  references it, and the sync step doesn't need to special-case it
+  the way an earlier version of this layout did) — uploaded GPX
+  files, `offline.pmtiles`, `terrain.pmtiles`, and
+  `kiwix/wikipedia.zim` (see `docs/development.adoc` for each).
+  Persisted via that bind mount, so a redeploy never touches it.
+* `.env` — regenerated every deploy (see below), lives here rather
+  than in `build/` for the same reason as the symlink: `docker
+  compose`/`podman compose` auto-load `.env` from the compose file's
+  own directory (as invoked, i.e. following the symlink's location,
+  same story as the volume path above).
 
 == The native deploy runner
 
@@ -224,9 +239,12 @@ on a push to `main`, with `runs-on: cube-host`:
   `actions/checkout@v4` — a leftover from when this job ran in a
   Node-less container; kept as-is since there's no reason to bring
   Node back in for something this already does.
-. Copies the checkout into `/srv/podman/maptool/` using plain `cp`/`rm`:
-  clears everything in the target except `data/`, copies the fresh
-  checkout over, then drops the copied `.git`.
+. Wipes and replaces `/srv/podman/maptool/build/` with the fresh
+  checkout (plain `cp`/`rm`, dropping the copied `.git`), then
+  `ln -sf`s `docker-compose.yaml` up to it — self-healing (harmless
+  to redo every deploy) and, being a fresh checkout each time, nothing
+  in `build/` needs preserving the way `data/`/`.env` (both a level
+  up, see "Layout on the server" above) do.
 . `sudo systemctl restart podman-compose@maptool.service`. The service
   (`/etc/systemd/system/podman-compose@.service`, a systemd template
   instantiated as `podman-compose@maptool.service`) owns the actual