fix: mount betterframe-data volume on server container

secret.key, firmware signing keys, and all encrypted data require
persistent storage at /var/lib/betterframe. Without this volume,
every redeploy regenerates keys and breaks all encrypted fields.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -38,6 +38,7 @@ services:
         source: ${SERVER_SEC_CONFIG:-./sec-config.yaml}
         target: /home/bsb/sec-config.yaml
         read_only: true
+      - betterframe-data:/var/lib/betterframe
     expose:
       - "18080"
       - "18081"