fix(ci): deploy by SHA tag, not mutable :latest

Deploy now pulls images pinned to $CI_COMMIT_SHA instead of :latest,
eliminating race-condition deployments where a concurrent pipeline
overwrites the mutable latest tag before deploy runs.

Changes:
- docker-compose.yml: image tags use ${IMAGE_TAG:-latest} env var
- deploy step: IMAGE_TAG=$CI_COMMIT_SHA docker compose pull + up
- scp docker-compose.yml to VPS before running deploy commands

infra/docker/docker-compose.yml

@@ -4,7 +4,7 @@ services:
   # Nginx Reverse Proxy + Frontend Static Files
   # Routes /api and /ws to backend, serves frontend WASM directly
   proxy:
-    image: registry.gitlab.com/mytheclipse-group/gmw/bete-proxy:latest
+    image: registry.gitlab.com/mytheclipse-group/gmw/bete-proxy:${IMAGE_TAG:-latest}
     container_name: imphenbot-proxy
     restart: unless-stopped
     labels:
@@ -29,7 +29,7 @@ services:
 
   # Backend Service (REST API + WebSocket)
   backend:
-    image: registry.gitlab.com/mytheclipse-group/gmw/bete-backend:latest
+    image: registry.gitlab.com/mytheclipse-group/gmw/bete-backend:${IMAGE_TAG:-latest}
     container_name: imphenbot-backend
     restart: unless-stopped
     env_file:
@@ -52,7 +52,7 @@ services:
 
   # Discord Gateway Service (Event capture and processing — no HTTP)
   discord-gateway:
-    image: registry.gitlab.com/mytheclipse-group/gmw/bete-discord-gateway:latest
+    image: registry.gitlab.com/mytheclipse-group/gmw/bete-discord-gateway:${IMAGE_TAG:-latest}
     container_name: imphenbot-discord-gateway
     restart: unless-stopped
     env_file: