Add Docker image, compose, and Gitea CI

- Multi-stage Dockerfile builds server + web into a single node:20-alpine
  image; runtime serves API on /api and the SPA from /app/public.
- Express now serves web/dist with an SPA fallback that skips /api so API
  misses still 404 cleanly.
- docker-compose.yml is a single-service deploy with a named volume for
  the SQLite database at /data/apothecary.db.
- .gitea/workflows/build.yml pushes :latest, :<sha>, and :semver tags to
  the Gitea container registry on main and v* tags.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,43 @@
+# syntax=docker/dockerfile:1.7
+
+# --- builder: compile server + web ---
+FROM node:20-alpine AS builder
+RUN apk add --no-cache python3 make g++
+WORKDIR /build
+
+COPY package*.json ./
+COPY server/package*.json ./server/
+COPY web/package*.json ./web/
+RUN npm ci && \
+    npm --prefix server ci && \
+    npm --prefix web ci
+
+COPY server ./server
+COPY web ./web
+RUN npm --prefix server run build && \
+    npm --prefix web run build
+
+# --- prod deps: production-only node_modules with native bindings rebuilt ---
+FROM node:20-alpine AS prod-deps
+RUN apk add --no-cache python3 make g++
+WORKDIR /deps
+COPY server/package*.json ./
+RUN npm ci --omit=dev
+
+# --- runtime ---
+FROM node:20-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production \
+    PORT=4000 \
+    APOTHECARY_DB=/data/apothecary.db
+
+COPY --from=prod-deps /deps/node_modules ./node_modules
+COPY --from=builder /build/server/dist ./dist
+COPY --from=builder /build/server/package.json ./package.json
+COPY --from=builder /build/web/dist ./public
+
+RUN mkdir -p /data
+VOLUME ["/data"]
+EXPOSE 4000
+
+CMD ["node", "dist/index.js"]