Persist settings.json across deploys via a data volume

The previous commit made Settings-saved API keys override .env, but the
key still never survived: settings.json was written to the container
filesystem, and every deploy runs `up -d --build`, which recreates the
container and discards it. Saving a rotated SABnzbd key and restarting
therefore still fell back to the stale .env value.

SETTINGS_FILE is now configurable and pointed at /data/settings.json on
a ./data bind mount, so runtime settings live on the host. The deploy
rsync also excludes data/ — it runs --delete and would otherwise wipe
the directory for not being in the repo, reintroducing the same bug.

This affected everything the Settings page writes, not just API keys:
timezone and a UI-changed login password were being reverted on every
deploy too.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -89,5 +89,18 @@ pipeline mechanics. Push to `main` on the `forgejo` remote
 and `LOGIN_PASSWORD` — this project was already doing this correctly
 before the Forgejo migration (compose file uses `${VAR}` substitution from
 `.env`, no hardcoded secrets), unlike `n64-tracker` which needed fixing.
-`settings.json` (timezone, changed login password) also persists
-server-side outside git.
+Runtime settings written by the Settings page (API-key overrides,
+timezone, changed login password) live in `settings.json` at
+`SETTINGS_FILE`, which the compose file points at `/data/settings.json`
+on the `./data` bind mount — i.e. `/mnt/user/appdata/greendale/data`.
+That mount is load-bearing: without it the file sits on the container
+filesystem, and every `up -d --build` recreates the container and
+silently discards it. `data/` is likewise excluded from the deploy
+rsync, which runs `--delete` and would otherwise remove it for not
+being in the repo.
+
+A key saved through the Settings page overrides the corresponding
+`.env` value at startup (see the block after the `*_API_KEY` reads in
+`app.py`); `.env` remains the source of truth for anything never
+overridden there. Both paths need a container restart to take effect,
+since the keys are read once at import.