Deploy: docker compose down before pull/up, not just up -d

up -d alone assumes the previous container releases port 8420 cleanly
before the new one binds -- it doesn't force that. The last three
deploys all failed with "port is already allocated" at exactly that
step; running compose down first (confirmed working when done manually
over SSH) guarantees the old container is fully stopped and removed
before the new one starts, closing the race.

.gitea/workflows/server-docker-build.yml

@@ -69,4 +69,4 @@ jobs:
           ssh-keyscan -p "$DEPLOY_PORT" "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
           ssh -i ~/.ssh/deploy_key -p "$DEPLOY_PORT" -o StrictHostKeyChecking=yes \
             espressoframe_deployer@"$DEPLOY_HOST" \
-            'cd ~/espresso-frame && docker compose pull && docker compose up -d'
+            'cd ~/espresso-frame && docker compose down && docker compose pull && docker compose up -d'

docs/widgets.md

@@ -227,6 +227,17 @@ three-layer CSS custom-property theme system -- this is an original
 reimplementation of that *architecture*, not a copy of its token file
 (see this repo's `CLAUDE.md` on copyleft dependencies).
 
+**What a theme actually changes, in practice**: the header/accent color
+is the most visible change, but `font_family` applies to *every* text
+element in the widget, not just the header title -- day labels,
+temperatures, task rows, event times, day numbers all switch fonts too
+(e.g. "Moss" is serif, "Ochre" a slab serif), often more noticeable than
+the accent color on text-heavy widgets. `radius`/`shadow` change the
+card's corners and whether it has a drop shadow at all (e.g. "Slate" is
+square-cornered with no shadow). Battery and text/static/whiteboard have
+no header, so for those a theme only shows up as font/radius/shadow
+differences, not an accent color.
+
 **A theme is purely stylistic, never functional color-coding.** Battery's
 charge-level red/yellow/green, calendar/tasks' per-owner event color
 chips, and text's user-authored inline run colors are status/identity