chore(compose): gate livekit behind 'sfu' profile so it stays dormant until enabled

A normal deploy no longer starts the livekit container (it would crashloop with
empty keys before provisioning). Enable with 'docker compose --profile sfu up -d'.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

DEPLOY.md

@@ -222,10 +222,12 @@ ufw allow 7881/tcp          # WebRTC-over-TCP fallback for restrictive networks
 If the VPS is behind NAT and LiveKit can't auto-detect its public IP, set `rtc.node_ip` in
 `livekit.yaml` to `118.95.33.89` and redeploy.
 
-**5. Deploy** (starts the livekit container alongside the app):
+**5. Deploy** (the livekit service is behind a `sfu` compose profile, so it stays dormant on a
+normal deploy — start it explicitly):
 ```bash
-cd /opt/bizgaze-support && ./deploy.sh
-docker compose ps            # expect both bizgaze-support AND bizgaze-livekit "Up"
+cd /opt/bizgaze-support && ./deploy.sh                 # rebuilds/starts the app as usual
+docker compose --profile sfu up -d                     # additionally starts the livekit container
+docker compose ps                                      # expect both bizgaze-support AND bizgaze-livekit "Up"
 ```
 
 **6. Verify**:

docker-compose.yml

@@ -33,6 +33,9 @@ services:
     image: livekit/livekit-server:v1.7
     container_name: bizgaze-livekit
     restart: unless-stopped
+    # Dormant by default: a normal `docker compose up -d` / deploy.sh does NOT start it. Enable SFU
+    # explicitly with `docker compose --profile sfu up -d` after setting the LIVEKIT_* vars (see DEPLOY.md).
+    profiles: ["sfu"]
     command: --config /etc/livekit.yaml
     environment:
       # key: secret, sourced from the same .env as the app so both sign/verify with the same secret.