fix(deploy-node): pass --env-file per-service so env-interpolated binds resolve (fleet-prometheus 0.0.0.0 leak)

Without --env-file, docker compose resolved variables from the repo root
(cwd), not from services/<service>/.env where the file actually lives.
This caused ${TAILSCALE_BIND_IP} to expand to empty string, binding
fleet-prometheus on 0.0.0.0:9090 instead of the Tailscale-only IP —
a security hole on the public VPS.

Guard mirrors the existing override-file pattern: only add --env-file
when the file exists, so services without .env continue to work as
before. Flag is injected into COMPOSE_CMD (before the `up` subcommand)
so docker compose sees it as a global option.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/deploy/deploy-node.sh

@@ -102,6 +102,11 @@ for service in "${SERVICES[@]}"; do
         COMPOSE_CMD="${COMPOSE_CMD} -f ${OVERRIDE_FILE}"
     fi
 
+    ENV_FILE="${REPO_PATH}/services/${service}/.env"
+    if [ -f "$ENV_FILE" ]; then
+        COMPOSE_CMD="${COMPOSE_CMD} --env-file ${ENV_FILE}"
+    fi
+
     $COMPOSE_CMD up -d --remove-orphans
 done