Backfill must read the SQLite volume that lives inside the api/jetstream
containers, so it has to be runnable via `deno task backfill:search`
from a Coolify exec shell.
The image previously inherited everything from a `COPY . .`, including
.env (secrets), local notes.db copies, and admin scripts that should
not run in prod containers.