feat(email): wire listmonk-hc into deploy + dev override + hc ramp-cap

- deploy.sh/deploy-dev.sh: bring up listmonk-hc (upstream image, excluded from
  build); document the one-time listmonk_hc DB create + --install.
- docker-compose.dev.override.yml: dev-only override (committed) that drops the
  prod host-port bindings and pins dev's own postgres volume (dev-pgdata) via
  compose !override tags. deploy-dev ships it as docker-compose.override.yml so
  syncing the canonical compose to the shared host no longer breaks dev's
  api-postgres (port :5432 clash + volume switch). Discovered + fixed while
  validating listmonk-hc on dev.
- pw-hc-rampcap.sh: healthcare analogue of pw-listmonk-rampcap, ramps the
  listmonk_hc cap 100->1000/h off /etc/postfix/hc-warmup-start, fully
  independent of the trucking ramp/cap.

scripts/deploy-dev.sh

@@ -60,12 +60,20 @@ done
 # and not overwritten.
 rsync -avz -e "$SSH" docker-compose.yml "$REMOTE:$DEV_DIR/docker-compose.yml"
 
+# Dev-only compose override: dev shares the host with prod, so it must NOT bind
+# the prod host ports (5432/9100/9101/...) and must use its own postgres data
+# volume (dev-pgdata). Shipped as docker-compose.override.yml (compose auto-loads
+# it). Without this, syncing the canonical compose makes dev's api-postgres try
+# to rebind prod's :5432 and switch volumes -> stack breakage. See
+# docs/healthcare-email-stream-plan.md.
+rsync -avz -e "$SSH" docker-compose.dev.override.yml "$REMOTE:$DEV_DIR/docker-compose.override.yml"
+
 echo ""
 echo "=== Rebuilding containers ==="
 
 # proxy-relay is an upstream image (no build context); `up --build` skips the
 # build for it but still (re)creates it from the compose definition.
-$SSH "$REMOTE" "cd $DEV_DIR && sudo docker compose up -d --build api site workers proxy-relay"
+$SSH "$REMOTE" "cd $DEV_DIR && sudo docker compose up -d --build api site workers proxy-relay listmonk-hc"
 
 echo ""
 echo "=== Deploy complete ==="