fix(qa): build the QA image before deploying the stack (#25)

Deploying the stack first failed with "pull access denied for
redefined-designs, repository does not exist or may require docker
login". The README had the Portainer stack creation ahead of the build,
so no local redefined-designs:qa image existed and Compose fell back to
pulling from Docker Hub, where the repository does not exist.

The build step now comes first in the one-time setup, and the review
workflow says to rebuild before restarting the stack — the stack builds
nothing itself and would otherwise run whatever was last tagged :qa.

pull_policy: never makes the failure legible: a missing local image now
reports itself as missing rather than as a registry authentication
problem. Noted as safe to remove if the NAS's Compose ever rejects the
key, since it only affects the error message.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.qa.yml

@@ -17,12 +17,23 @@
 #   QA_DB_PASSWORD  — deliberately not named DB_PASSWORD, so pasting the
 #                     production stack's variables here does nothing silently.
 #
-# Build the image on the NAS before starting the stack:
+# BUILD THE IMAGE BEFORE DEPLOYING THIS STACK. redefined-designs:qa exists only
+# on the NAS and is never pushed to a registry, so deploying first makes Compose
+# fall back to pulling from Docker Hub and fail with a misleading
+# "pull access denied ... repository does not exist or may require docker login".
+#
 #   sudo docker build --no-cache -t redefined-designs:qa /volume1/docker/redefined-designs
+#
+# For the same reason, leave Portainer's "Pull latest image" toggle off.
+# `pull_policy: never` below makes a missing image report itself as missing
+# rather than as a registry authentication problem. If the Docker Compose
+# version on the NAS ever rejects that key, it is safe to delete the line — it
+# only improves the error message.
 
 services:
   redefined-designs-qa:
     image: redefined-designs:qa
+    pull_policy: never
     container_name: redefined-designs-qa-syn
     environment:
       - TZ=America/Chicago