Persist settings.json across deploys via a data volume

The previous commit made Settings-saved API keys override .env, but the
key still never survived: settings.json was written to the container
filesystem, and every deploy runs `up -d --build`, which recreates the
container and discards it. Saving a rotated SABnzbd key and restarting
therefore still fell back to the stale .env value.

SETTINGS_FILE is now configurable and pointed at /data/settings.json on
a ./data bind mount, so runtime settings live on the host. The deploy
rsync also excludes data/ — it runs --delete and would otherwise wipe
the directory for not being in the repo, reintroducing the same bug.

This affected everything the Settings page writes, not just API keys:
timezone and a UI-changed login password were being reverted on every
deploy too.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yml

@@ -4,11 +4,17 @@ services:
     container_name: arr-summary
     ports:
       - "${HOST_PORT:-5055}:5000"
+    volumes:
+      # Runtime settings (API keys saved via the Settings page, timezone,
+      # changed login password) must outlive `up -d --build`, which
+      # recreates the container and discards its filesystem.
+      - ./data:/data
     environment:
       # ── Login / proxy ──────────────────────────────────────
       - LOGIN_PASSWORD=${LOGIN_PASSWORD}
       - SECRET_KEY=${SECRET_KEY}
       - SCRIPT_NAME=${SCRIPT_NAME:-}
+      - SETTINGS_FILE=/data/settings.json
       # ── Media services ─────────────────────────────────────
       - ARR_HOST=${ARR_HOST}
       - SONARR_API_KEY=${SONARR_API_KEY}