Guard against Petal starting on an unmounted data volume

The mountpoint directory exists whether or not the encrypted volume is
mounted, so a boot where the unlock failed would start Petal against an
empty unencrypted directory and serve a blank database -- the failure
mode that looks like data loss. .volume-ok lives on the encrypted
filesystem and is bind-mounted with create_host_path:false, so its
absence is a container start failure instead of a silent empty DB.

docker-compose.yml

@@ -51,6 +51,20 @@ services:
       # A bind mount, not a named volume: petal.db must be trivially reachable
       # from the host for the nightly backup and for a restore.
       - ./data:/data
+      # Mount-liveness guard. On the VPS ./data is an encrypted LUKS volume, and
+      # the mountpoint directory still exists when that volume is NOT mounted —
+      # so without this, a boot where the unlock failed would start Petal
+      # against an empty unencrypted directory and quietly serve a blank
+      # database. .volume-ok lives on the encrypted filesystem, and
+      # create_host_path: false turns its absence into a container start
+      # failure instead. Harmless elsewhere: create the file once and it is a
+      # no-op. See deploy/README.md §6.
+      - type: bind
+        source: ./data/.volume-ok
+        target: /data/.volume-ok
+        read_only: true
+        bind:
+          create_host_path: false
     networks:
       - traefik
       - internal