fix(deploy): harden production web startup

[Cybernetic-Ransomware]

Summary

• Remove the dangling //# sourceMappingURL=chart.umd.min.js.map reference from the vendored Chart.js build so collectstatic (WhiteNoise CompressedManifestStaticFilesStorage) no longer fails post-processing on a missing .map file.
• Make the production web container startup fail-fast: set -e before migrate/collectstatic, and exec gunicorn ... so Gunicorn replaces the shell instead of running under a shell that swallowed an earlier failure.
• Disable Gunicorn's unused control socket (--no-control-socket) to stop the Permission denied: '/home/appuser' error, without creating a home directory or changing the image's user.

Test plan

• docker compose -f docker/docker-compose-traefik.yml -f docker/docker-compose.cd.yml config renders cleanly with fictitious values (same set as the "Validate production Compose stack" CI job)
• Rendered web.command confirmed to contain set -e / migrate / collectstatic / exec gunicorn ... --no-control-socket
• uv run python manage.py collectstatic --noinput exits 0, no chart.umd.min.js.map reference, no post-processing failure
• just lint (ruff check, ty check, codespell, bandit) passes
• uv run pre-commit run (staged files) passes
• just test — 558 passed