feat: produce worker deployment + web producer/collective/branding UI + mobile CSS (wave-2c)

Deployment (t4g2): media-worker gains font-dejavu (drawtext lower-thirds)
and a dedicated produce-worker compose service running src/produce.ts —
claims video_processing_jobs compose|mix by lane, renders assembled/
overlaid/voiced cuts, registers derived library assets. Deliberately its
own process so a remote-lane box needs only Postgres + S3 + ffmpeg.

Web: compose media attachments UI (t2), Producer panel in the video
drawer (t5), collective creation + branding settings + shell branding
(brandweb), mobile CSS (mcss: touch targets, icon sizing, safe areas).

infra/occupymedia/docker-compose.app.yml

@@ -163,6 +163,24 @@ services:
       redis: { condition: service_healthy }
     restart: unless-stopped
 
+  # Produce worker (editor v2): claims video_processing_jobs kind compose|mix,
+  # renders assembled/overlaid/voiced cuts, registers derived library assets.
+  # Deliberately its own process: a remote-lane box needs only Postgres +
+  # object storage + ffmpeg (see apps/media-worker/src/produce.ts header).
+  produce-worker:
+    build:
+      context: ../..
+      dockerfile: infra/media-worker.Dockerfile
+    command: ["pnpm", "--filter", "@tactical-media-broadcast-hub/media-worker", "exec", "tsx", "src/produce.ts"]
+    environment:
+      <<: *appenv
+      MEDIA_WORKER_LANE: local
+      MEDIA_SCRATCH_DIR: /var/lib/media-worker/produce
+    volumes: [mediaworkerstate:/var/lib/media-worker]
+    depends_on:
+      postgres: { condition: service_healthy }
+    restart: unless-stopped
+
   cloudflared:
     image: cloudflare/cloudflared:latest
     command: ["tunnel", "--no-autoupdate", "run", "--token", "${CLOUDFLARE_TUNNEL_TOKEN:?}"]