Stop pretending Vercel is an option

It was never used. The repository lives on a self-hosted Gitea, which
Vercel's git integration cannot connect to at all — so the documented
route amounted to "mirror to GitHub first", and nobody did.

vercel.json is gone, and with it the branch in next.config.ts that
switched off `output: "standalone"` when the VERCEL variable was
present. That branch was the only functional trace; everything else was
documentation and comments describing a second deployment path that did
not exist.

DEPLOYMENT.md loses its "two supported ways" framing and the whole
Vercel section — about fifty lines. Several statements next to it were
stale for a different reason and are corrected in the same pass: the
outbound-firewall table still listed Supabase's pooler (the database is
a container now, nothing leaves the server), the prerequisites still
demanded an existing Supabase project, and the .env table still asked
for a pooler connection string instead of the two new passwords.

The nightly job is described as what it is — a container in
docker-compose.yml — rather than as a replacement for Vercel Cron.

Migrations keep their references: two comments from July mention Vercel
Cron, and they describe what was true when they were written.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

next.config.ts

@@ -46,10 +46,9 @@ const nextConfig: NextConfig = {
   // Emits a self-contained .next/standalone server (only the deps actually
   // used at runtime, no full node_modules) — what the Dockerfile copies in.
   //
-  // Auf Vercel ist das falsch: dort baut die Plattform selbst und erwartet
-  // die übliche Ausgabe. `VERCEL` setzt sie in jeder Baustrecke, die Angabe
-  // entfällt dort also von selbst — und der Docker-Weg bleibt unberührt.
-  output: process.env.VERCEL ? undefined : "standalone",
+  // Ohne Ausnahme: die Anwendung läuft in einem Container auf einem eigenen
+  // Server, und dort ist das der richtige Ausgabemodus.
+  output: "standalone",
   // Baseline security headers (clickjacking, MIME-sniffing, referrer leakage,
   // browser feature access) plus the report-only CSP described above.
   async headers() {