fix deploy: targeted compose restart, Gitea login_name, WP DB token

- docker compose up -d with explicit service names instead of
  --remove-orphans (avoids rootless Docker network detachment bug)
- GiteaClient.change_admin_password: add required login_name and
  source_id fields (was returning 422)
- provision_woodpecker: read WP API token from woodpecker DB hash
  (Woodpecker API uses its own tokens, not Gitea tokens)
- Pin fhirworx/rustfs and fhirworx/postgresql to :latest (not built
  by pipeline, COMMIT_SHA tag doesn't exist)

src/api/auth/deploy.py

@@ -187,10 +187,25 @@ def deploy(
     # Set COMMIT_SHA for compose image tags
     _set_env_var(env_path, "COMMIT_SHA", f"sha-{commit_sha[:8]}")
 
-    # Restart services
+    # Restart only services whose images or env changed.
+    # Avoid --remove-orphans which recreates containers and breaks
+    # network attachments on rootless Docker.
+    restart_services = [
+        "notebooks",
+        "zotero",
+        "docs",
+        "api",
+        "mc",
+        "gitea",
+        "woodpecker-server",
+        "woodpecker-agent",
+        "nessie",
+        "polaris",
+        "grafana",
+    ]
     try:
         subprocess.run(
-            ["docker", "compose", "up", "-d", "--remove-orphans"],
+            ["docker", "compose", "up", "-d", *restart_services],
             cwd=str(cwd),
             check=True,
             capture_output=True,
@@ -227,7 +242,7 @@ def deploy(
             shutil.copy2(env_bak, env_path)
             try:
                 subprocess.run(
-                    ["docker", "compose", "up", "-d", "--remove-orphans"],
+                    ["docker", "compose", "up", "-d", *restart_services],
                     cwd=str(cwd),
                     check=True,
                     capture_output=True,