docs: run a job by hand through systemd-run

[Bilb]

session-ops run <job> --dry-run, as every job doc gives it, fails on the host with missing <VAR> in the environment: session-ops run does not read the job's env files, its unit loads them as root, and the job's account cannot read them either.

• deploy/README.md gives the systemd-run command that runs a job by hand with its account, env files and state directory, and where a job's drop-in names them.
• Every job doc's dry-run line, and crowdin-sync's single-target re-run, points to it.
• expiry.toml.example points to the token-expiry doc instead of the bare command.

Docs only.