pict-rs itself doesn't emit Access-Control-* headers; production papers
over that with an nginx vhost (deploy/server-deploy/modules/services/
pict-rs.nix), which the dev compose was claiming to mirror but didn't.
Cross-origin uploads from the webapp dev server got blocked.
Move pict-rs to internal-only (`expose`) and add a pict-rs-nginx sidecar
publishing :6033, reusing the exact CORS block from the prod nix
module. Closes the dev/prod divergence so browser upload behavior
matches between local and deployed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
