Add keep overview command and a docker-compose deploy wrapper

keep overview gives an admin a cross-vault view of every recipient and
grant in one screen, instead of walking vaults one at a time via
/vaults/:key/recipients. scripts/deploy.sh pulls a project's env from
keep before running docker compose up, for VPS deploys of several
docker-compose projects.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/deploy.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Pulls a project's env from keep, then brings its docker compose stack up.
+#
+# Usage:
+#   ./deploy.sh <project> [env]
+#
+# Expects, per project, a directory at $DEPLOY_ROOT/<project>/ containing
+# a docker-compose.yml. Vault key pulled is "<project>/<env>" (env
+# defaults to "production"). Requires a keep identity already registered
+# and granted read access to that vault on this machine
+# (see INTEGRATION.md).
+set -euo pipefail
+
+project="${1:?usage: deploy.sh <project> [env]}"
+env="${2:-production}"
+root="${DEPLOY_ROOT:-/opt/docker}"
+dir="$root/$project"
+
+if [ ! -d "$dir" ]; then
+  echo "error: $dir does not exist" >&2
+  exit 1
+fi
+
+keep pull "$project/$env" --out "$dir/.env"
+(cd "$dir" && docker compose up -d)