release: open days older than the first entry ever logged (#4)

## Fixed

- Days older than the first entry ever logged can now be opened. Picking a
  date from before anything was recorded landed on a dead end.

## Changed

- Releases are built by CI. Merging this pull request builds the image,
  tags it `vYYYYMMDD-N` and `latest`, pushes both, and creates the git
  tag. Nothing is built locally any more.
- `make image`, `push`, `release`, `seed`, `icons` and `vendor` are gone;
  the Makefile is down from 151 lines to 71. The two rare commands are
  written out in the README.
- Every push to `dev` now runs `make check` in CI.

## Deployment

No new or renamed environment variables, and `compose.yaml` is unchanged —
nothing to copy to the server this time. Pull the new image once CI reports
the build finished.

---------

Co-authored-by: Esa Kataja <[email protected]>
Reviewed-on: #4

CONTRIBUTING.md

@@ -29,9 +29,9 @@ git switch dev && git reset --hard main
 git push --force-with-lease origin dev
 ```
 
-`make image` refuses to run outside `main`. That check has to be local: the
-tag and the image are made before anything reaches the remote, so branch
-protection cannot catch a release built from the wrong branch.
+The release workflow only triggers on `main`, and `main` only moves through a
+pull request, so a release can never be built from the wrong branch. Nothing
+needs to check for it.
 
 ## Commit messages
 
@@ -71,10 +71,20 @@ release: repair the catalog 404 and stop the page jumping
 
 `main`'s log is then one line per deployment, which is what that branch is
 for, and the pull request body serves as the release notes. No version in the
-title — the CalVer tag is not created until `make image` runs after the merge.
+title — CI creates the CalVer tag after the merge, so it is not known yet.
 
 The types above are for `dev`, where a commit really does do one thing.
 
+## Deploying
+
+The server keeps its own `compose.yaml` and `.env`. Neither is pulled from
+here, so a release that renames a variable, adds one, or changes a mount
+needs both copied across **in the same deploy** — otherwise the container
+comes up against the old names and the app refuses to start.
+
+Anything in this repository that reaches the server by hand belongs in the
+release notes, flagged as breaking.
+
 ## Things that are easy to get wrong
 
 - **The interface is Finnish.** Code, comments, this file and the PRD are