deploy: use named volumes for certs/html/acme, keep data bind mount

certs, html and acme are shared across nginx-proxy, acme-companion and
the acme-ip service, so they become named volumes (dropping the nginx-
prefix). The vhost.d mount is removed: acme-companion only needs it with
ACME_HTTP_CHALLENGE_LOCATION=true or letsencrypt_user_data, and users
who customize nginx config can mount their own. ./data stays a bind
mount so the SQLite state stays directly backup-able. README updated.

README.md

@@ -53,8 +53,8 @@ Let's Encrypt 支持为公网 IP 签发证书（2026 年起可用，有效期约
      command: daemon
      restart: always
      volumes:
-       - ./nginx-certs:/acme.sh
-       - ./nginx-html:/usr/share/nginx/html
+       - certs:/acme.sh
+       - html:/usr/share/nginx/html
        - /var/run/docker.sock:/var/run/docker.sock:ro
      networks: [proxy]
    ```
@@ -112,6 +112,6 @@ Telegram 只接受 443/80/88/8443 端口。
 
 ## 备注
 
-- 数据持久化于 `data/task_queue.db`，容器部署需挂载该目录
+- 数据持久化于 `data/task_queue.db`，compose 部署使用 bind mount `./data`（保持目录形式便于备份）
 - 运行环境需安装 ffmpeg（Docker 镜像已内置）
 - 测试：`cargo test --workspace`