fix: mount src and data volumes in container targets

Bind-mount src/ and data/ alongside plugins/ and config so the
container picks up code changes without rebuilding. Update Makefile
targets, compose file, and INSTALL.md to match.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/INSTALL.md

@@ -54,12 +54,17 @@ make up
 ```bash
 podman build -t derp .
 podman run -d --name derp \
-    -v ./config/derp.toml:/app/config/derp.toml:ro,Z \
+    -v ./src:/app/src:ro,Z \
     -v ./plugins:/app/plugins:ro,Z \
+    -v ./config/derp.toml:/app/config/derp.toml:ro,Z \
+    -v ./data:/app/data:Z \
     derp --verbose
 ```
 
-The image contains only the Python package. Config and plugins are bind-mounted at runtime, so edits on the host are picked up by `!reload` without rebuilding.
+The image contains only the Python runtime and compiled dependencies. Source
+code, plugins, config, and data are bind-mounted at runtime. Code and plugin
+edits on the host take effect on restart (or via `!reload` for plugins).
+Only rebuild the image when adding or updating pip dependencies.
 
 ## Configuration