Image: ttrpg-app:local named a registry image. Without --build flag,
compose tried pull first -> 'pull access denied' (private, unpublished).
Then fell back to build. Confusing error.
Removed image: field. Compose now auto-names (docker-app), always builds
local, never attempts registry pull. Base images (node/caddy) pull once
on first build, then cache. No pull_policy needed.
docker compose up (from docker/ dir) now works clean.