[vazra]

Found by the E2E audit.

• Failed deploys only said "compose up: exit status 1", so users (activity feed, deploy events, app status) never learned why (pull unauthorized, port in use, bad image). The error now includes the relevant lines of docker compose's own output, trimmed, with registry credentials redacted. Same for rollback and pull.
• Rollback, restart and pull during a running deploy returned 200/202 but did nothing. They now return 409 "a deploy is already running for this app, try again when it finishes"; a rollback that loses the race writes the previous compose file back.
• A reconcile skipped behind a running deploy was never retried, so a compose edit made during a deploy could sit undeployed with a stale stored hash until some later, surprising redeploy. One reconcile per app is now queued for when the running deploy finishes (a no-op when nothing changed; cannot loop).
• Metrics prune with an unknown tier pruned the raw tier. Now 400 listing the valid tiers.

Docs: reference/api.md (409s, prune tiers), architecture/reconciler.md.

Tests: compose error extraction and redaction, audit summary, 409 for rollback/restart/pull, rollback race restores the file, skipped reconcile retried after the deploy finishes (real deploy tracker, -race), prune tier validation.