feat: production deploy (Fly + R2) + frame controls and picker glow

Deploy:
- Multi-stage Dockerfile (shadow-cljs release → Python+ffmpeg runtime), fly.toml
  (one machine, scale-to-zero, SQLite on a volume), .dockerignore, DEPLOY.md
- Same-origin release build: api-port defaults "9001" for dev, "" in release
  (no CORS in prod)
- env-driven settings (SECRET_KEY/DEBUG/ALLOWED_HOSTS/DB_PATH/CSRF), WhiteNoise
  serving static + the SPA, R2 (S3-compatible) media storage when R2_* is set
- thumbnails reworked storage-agnostic: download clip, ffmpeg select-pass, upload
  tiles via default_storage (R2 in prod, disk in dev)
- pin channels/daphne; add whitenoise/django-storages/boto3

UI:
- frame step buttons flanking play (disabled at timeline bounds)
- Add-annotation button moved into the toolbar, made prominent
- picker mode pulses a 1-bit glow on clips / frame readout / (while linking)
  annotation bars; linking an annotation bar inserts a timeline link

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1
+
+# ---- stage 1: compile the ClojureScript frontend (release build) ----
+# Java (for the shadow-cljs compiler) + Node (npm deps / launcher).
+FROM clojure:temurin-21-tools-deps AS frontend
+WORKDIR /build/tl
+RUN apt-get update && apt-get install -y --no-install-recommends nodejs npm \
+    && rm -rf /var/lib/apt/lists/*
+COPY tl/package.json tl/package-lock.json ./
+RUN npm ci
+COPY tl/ ./
+# api-port is left "" in the release build → the app talks to its own origin.
+RUN npx shadow-cljs release app
+
+# ---- stage 2: Python runtime — Django ASGI (daphne) + ffmpeg ----
+FROM python:3.12-slim-bookworm AS runtime
+ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 PIP_NO_CACHE_DIR=1
+RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY requirements.txt ./
+RUN pip install -r requirements.txt
+COPY manage.py ./
+COPY server/ ./server/
+COPY scenes/ ./scenes/
+# the built SPA (index.html, css, fonts, icons, js/compiled/app.js) for WhiteNoise
+COPY --from=frontend /build/tl/resources/public ./tl/resources/public
+RUN python manage.py collectstatic --noinput
+EXPOSE 8000
+# migrate on boot (idempotent; the volume holds the SQLite db), then serve ASGI.
+CMD ["sh", "-c", "python manage.py migrate --noinput && exec daphne -b 0.0.0.0 -p 8000 server.asgi:application"]