Add plug-in-only filter to web app + deploy script

- Checkbox 'plug-in only (≤ 0.8 kW, no electrician)' filters the leaderboard
  client-side and re-picks the top recommendation from visible rows.
  Filter state is persisted in localStorage.
- scripts/deploy.sh: idempotent rsync + systemd setup against the
  'thuisbatterij' SSH alias. Run after provisioning the h4a workload.

scripts/deploy.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Deploy (or redeploy) the web app to the h4a workload.
+#
+# Prereqs:
+#   - Workload provisioned via h4a (`thuisbatterij`).
+#   - SSH alias `thuisbatterij` in ~/.ssh/config pointing at it.
+#     If h4a rotates the VM, update the HostName in your SSH config and re-run.
+#
+# Usage:  scripts/deploy.sh
+set -euo pipefail
+
+ALIAS="thuisbatterij"
+APP_DIR="/opt/thuisbatterij"
+
+echo "→ checking SSH"
+ssh -o BatchMode=yes -o ConnectTimeout=8 ${ALIAS} 'true'
+
+echo "→ rsyncing source to ${ALIAS}:${APP_DIR}"
+ssh ${ALIAS} "mkdir -p ${APP_DIR}"
+rsync -az --delete \
+  --exclude='.venv' --exclude='__pycache__' --exclude='*.pyc' \
+  --exclude='.pytest_cache' --exclude='.ruff_cache' --exclude='.mypy_cache' \
+  --exclude='data/processed' --exclude='.DS_Store' --exclude='.env' \
+  --exclude='.git' \
+  ./ ${ALIAS}:${APP_DIR}/
+
+echo "→ installing python deps"
+ssh ${ALIAS} "cd ${APP_DIR} && \
+  apt-get install -y python3-venv python3.12-venv >/dev/null 2>&1 && \
+  ([ -d .venv ] || python3 -m venv .venv) && \
+  .venv/bin/pip install -q --upgrade pip && \
+  .venv/bin/pip install -q -e ."
+
+echo "→ installing/updating systemd unit"
+ssh ${ALIAS} "cat >/etc/systemd/system/thuisbatterij.service <<UNIT
+[Unit]
+Description=Thuisbatterij payback web app
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=${APP_DIR}
+ExecStart=${APP_DIR}/.venv/bin/gunicorn pluginbattery.web:app --bind 0.0.0.0:8080 --workers 1 --timeout 180
+Restart=on-failure
+RestartSec=3
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+systemctl stop h4a-app.service 2>/dev/null || true
+systemctl disable h4a-app.service 2>/dev/null || true
+systemctl daemon-reload
+systemctl enable --now thuisbatterij.service
+systemctl restart thuisbatterij.service"
+
+sleep 3
+echo "→ smoke test"
+ssh ${ALIAS} "curl -sf http://127.0.0.1:8080/healthz && echo"
+
+echo "→ done. If first deploy or DNS just changed, expose + bounce caddy:"
+echo "    ssh ${ALIAS} 'systemctl restart caddy'"