review fixes: light-mode contrast, tz robustness, deploy copy

- admin: maroon buttons use .danger class (white text); replace hardcoded
  #333/#ff8a8a/drop-target colors with theme vars so light mode is legible
- time.ts: force hourCycle h23 (no 24:00 artifact), drop dead 24-guard
- Makefile/README: rsync with excludes instead of `cp -a .` so .git and the
  dev DB don't ship to /opt; add rsync to deps

Makefile

@@ -26,7 +26,7 @@ build:
 
 ## deps: install Node.js, pnpm and native-module build tools (Fedora)
 deps: require-root
-	dnf install -y nodejs gcc-c++ make python3
+	dnf install -y nodejs gcc-c++ make python3 rsync
 	corepack enable
 
 ## install: full production install on a fresh checkout (Fedora)
@@ -41,9 +41,14 @@ service: require-root
 	# Dedicated system user (no login, no home).
 	id -u $(SERVICE_USER) >/dev/null 2>&1 || \
 		useradd --system --no-create-home --shell /usr/sbin/nologin $(SERVICE_USER)
-	# Copy the whole tree so pnpm's symlinked node_modules stay intact.
+	# Copy the tree (preserving pnpm's symlinked node_modules) but leave behind
+	# the repo metadata, local dev database, and editor/nix cruft.
 	mkdir -p $(PREFIX)
-	cp -a . $(PREFIX)/
+	rsync -a --delete \
+		--exclude='.git' --exclude='.direnv' --exclude='.env' \
+		--exclude='*.db' --exclude='*.db-wal' --exclude='*.db-shm' \
+		--exclude='$(PREFIX)' \
+		./ $(PREFIX)/
 	# Config + secrets — never clobber an existing env file.
 	mkdir -p $(CONFDIR)
 	test -f $(CONFDIR)/wutzcalc.env || \