Add two self-contained compose stacks:

- docker/local: minimal dev stack (ATOM + Ollama + agent/proxy/embedder
  + UI). No TEE/attestation, no Traefik, no guardrails, no audit pipeline.
- docker/prod: full stack (Traefik TLS, ATOM, Ollama, guardrails, audit
  pipeline, image-embedder, optional Cloudflare tunnel). aTLS is opt-in.

Each stack is a single docker-compose.yaml with its own .env and proxy
router config — no sed-driven env mutation.

Rewrite Makefile to simple targets: build/docker/docker-push, up/down/
restart/logs/clean-volumes (local), up-prod/down-prod/restart-prod/
logs-prod. Cube images use ${CUBE_TAG} matching `make docker` (:latest
and :VERSION). ATOM uses ghcr.io/absmach/atom:latest and atom-ui:latest.

deploy-cloud workflow: inline the cloud logs command (dropped make
logs-cloud). Legacy docker/compose.yaml and friends are kept for the
existing cloud CD and smoke test.