feat(compose): remote build server and registry for prebuilt deploys

Problem

Compose stacks with build: directives currently build on the deploy server. Applications already support a split flow: build on a dedicated build server, push to a registry, then deploy prebuilt images on the target server. Compose lacks this, which blocks common setups where build capacity and deploy targets differ (e.g. CI/build VPS + production swarm node).

Proposed solution

Mirror the application remote-build flow for Compose:

• Optional build server and build registry on compose services
• Build/push on the build host when configured
• Deploy host runs pull + up --no-build instead of local --build
• Registry login on both build and deploy hosts when needed
• Split build/deploy logging, ACL validation, and server delete guardrails for buildServerId

Implementation

Tracked in PR #5159.

Acceptance criteria

• Compose settings expose Build Server + Build Registry (same UX pattern as applications)
• Same-server compose deploys behave unchanged when no build server is set
• Split build/deploy: images build on build host, deploy host pulls and starts without --build
• Deployment logs include both phases when servers differ
• Cross-org registry association rejected on compose update
• Server delete blocked when referenced as compose build host

Start by reviewing PR #5159 and the existing application remote-build flow, then compare the Compose settings and deployment path. Done means the listed acceptance criteria pass: build and deploy phases split correctly, same-server behavior is unchanged, logs cover both phases, registry and ACL checks work, and build-server deletion is guarded.