fix: only pull app images during deploy, not infra images

docker compose pull without arguments pulls ALL services including
getmeili/meilisearch:latest — a recent Meilisearch version bump broke
compatibility with existing data on the server, causing meilisearch to
crash immediately on restart.

CI deploy now only pulls the 5 custom app images (backend, runner, ui,
caddy, pocketbase). Infrastructure images (meilisearch, valkey, minio,
redis, crowdsec) are updated deliberately via `just pull-infra`.

Also add pocketbase to `just pull-images` now that it's a custom image.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -295,7 +295,7 @@ jobs:
             "${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}" \
             'set -euo pipefail
              cd /opt/libnovel
-             doppler run -- docker compose pull
+             doppler run -- docker compose pull backend runner ui caddy pocketbase
              doppler run -- docker compose up -d --remove-orphans'
 
   # ── Gitea release ─────────────────────────────────────────────────────────────

justfile

@@ -63,7 +63,7 @@ build-push: build push
 
 # Pull all images from Docker Hub (uses GIT_TAG from Doppler)
 pull-images:
-    {{doppler}} docker compose pull backend runner ui caddy
+    {{doppler}} docker compose pull backend runner ui caddy pocketbase
 
 # Pull all third-party base images (minio, pocketbase, etc.)
 pull-infra: