fix: pull_policy: build so portainer doesn't chase docker hub

Portainer's "Pull and redeploy" runs `compose pull` before `compose up`.
With `image: kaiser-natron:portainer` set, that tries to pull the image
from Docker Hub and fails with "pull access denied" because the image
only exists as a local build artifact. `pull_policy: build` tells
compose to skip the pull step for this service.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -14,6 +14,10 @@ services:
       context: .
       dockerfile: Dockerfile
     image: kaiser-natron:portainer
+    # Only build locally — never try to pull from a registry. Portainer's
+    # "Pull and redeploy" runs `compose pull` first, which would otherwise
+    # try to resolve `kaiser-natron:portainer` against Docker Hub and fail.
+    pull_policy: build
     restart: unless-stopped
     ports:
       - "5555:80"