Stage: run the per-member key seed from the image, not the volume

Ready to build, not yet deployed — deploying the repointed scheduler command
without the new image would break the seed on schedule, which is why this sits on
a branch with the ordering written down.

- Dockerfile: COPY sync-keys.js /app/code/sync-keys.js; rule 3 in the header now
  states the one exception (operational scripts that must not depend on a volume).
- CloudronManifest.json: scheduler command repointed to /app/code/sync-keys.js.
- README: ordering (build -> deploy -> verify -> delete the volume copy), and the
  table row moved from the volume layer to the image layer.

After deploy: delete /app/data/sync-keys.js, but keep it until you are past the
rollback window — the previous image tag still runs the volume copy.

CloudronManifest.json

@@ -26,7 +26,7 @@
         "scheduler": {
             "librechat_key_sync": {
                 "schedule": "*/10 * * * *",
-                "command": "cd /app/code/librechat/api && node /app/data/sync-keys.js"
+                "command": "cd /app/code/librechat/api && node /app/code/sync-keys.js"
             }
         }
     },