Persist settings.json across deploys via a data volume

The previous commit made Settings-saved API keys override .env, but the
key still never survived: settings.json was written to the container
filesystem, and every deploy runs `up -d --build`, which recreates the
container and discards it. Saving a rotated SABnzbd key and restarting
therefore still fell back to the stale .env value.

SETTINGS_FILE is now configurable and pointed at /data/settings.json on
a ./data bind mount, so runtime settings live on the host. The deploy
rsync also excludes data/ — it runs --delete and would otherwise wipe
the directory for not being in the repo, reintroducing the same bug.

This affected everything the Settings page writes, not just API keys:
timezone and a UI-changed login password were being reverted on every
deploy too.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app.py

@@ -15,7 +15,11 @@ from flask import Flask, render_template, request, jsonify, redirect, url_for, s
 # Suppress SSL warnings for Unraid's self-signed certificate
 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
-SETTINGS_FILE = os.path.join(os.path.dirname(__file__), "settings.json")
+# Must point at a path that survives `docker compose up --build` — the
+# container filesystem does not. See the data volume in docker-compose.yml.
+SETTINGS_FILE = os.environ.get(
+    "SETTINGS_FILE", os.path.join(os.path.dirname(__file__), "settings.json")
+)
 
 def load_settings():
     try:
@@ -27,6 +31,7 @@ def load_settings():
 def save_settings(data):
     existing = load_settings()
     existing.update(data)
+    os.makedirs(os.path.dirname(SETTINGS_FILE) or ".", exist_ok=True)
     with open(SETTINGS_FILE, "w") as f:
         json.dump(existing, f, indent=2)