fix(deploy): drop server sysctls under host net (runc rejects per-netns sysctl)

network_mode: host + sysctls: net.ipv4.ping_group_range fails at container create:
"sysctl not allowed in host network namespace" — runc refuses a per-netns sysctl
when there's no separate netns. Remove it; under host net the server uses the HOST's
ping_group_range (set on the booth via /etc/sysctl.d). Fixes the park-buzi-server-1
start failure introduced by c87dcb2.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

docker-compose.prod.yml

@@ -47,11 +47,10 @@ services:
     # Listens on :3000 directly on the host (Caddy proxies it). Loopback to vision:
     environment:
       VISION_URL: http://127.0.0.1:8089
-    # Reader liveness ping (Dingtian/GEE QR push-only readers): on host net the server uses the
+    # NB: NO `sysctls:` here. net.ipv4.ping_group_range is a per-netns sysctl; under host net
-    # HOST's net.ipv4.ping_group_range — ensure the host sets it (see appliance-provisioning).
+    # there is no separate namespace, and runc REFUSES it ("not allowed in host network
-    # The container-level sysctl below is a no-op under host net but kept as documentation.
+    # namespace"). Reader liveness ping uses the HOST's setting instead — the booth host must
-    sysctls:
+    # set net.ipv4.ping_group_range (see appliance-provisioning §7 / disk-os-hardening).
-      - net.ipv4.ping_group_range=0 2147483647
     logging:
       driver: json-file
       options: