chore(infrastructure): force image re-pull on redeploy for Portainer

pull_policy: always on the four studioflow services (migrate, api,
worker, frontend) so redeploying the stack in Portainer actually fetches
the latest pushed image instead of reusing a stale local layer for the
mutable `latest`/IMAGE_TAG reference. Third-party pinned images
(postgres, redis) are left on default pull behavior.

infrastructure/docker-compose.yml

@@ -3,6 +3,7 @@ services:
   # Runs database migrations once before the API and worker start.
   migrate:
     image: git.devils.zone/devil/youtube-studio-flow-backend:${IMAGE_TAG:-latest}
+    pull_policy: always
     command: npx prisma migrate deploy
     restart: "no"
     environment:
@@ -15,6 +16,7 @@ services:
 
   api:
     image: git.devils.zone/devil/youtube-studio-flow-backend:${IMAGE_TAG:-latest}
+    pull_policy: always
     restart: unless-stopped
     environment:
       NODE_ENV: production
@@ -54,6 +56,7 @@ services:
 
   worker:
     image: git.devils.zone/devil/youtube-studio-flow-backend:${IMAGE_TAG:-latest}
+    pull_policy: always
     restart: unless-stopped
     command: node dist/worker.js
     environment:
@@ -82,6 +85,7 @@ services:
     # Dockerfile default, /api/v1) — the relative path works because Traefik serves both
     # frontend and API on the same domain.
     image: git.devils.zone/devil/youtube-studio-flow-frontend:${IMAGE_TAG:-latest}
+    pull_policy: always
     restart: unless-stopped
     labels:
       - "traefik.enable=true"