Add Docker image, compose, and Gitea CI

- Multi-stage Dockerfile builds server + web into a single node:20-alpine
  image; runtime serves API on /api and the SPA from /app/public.
- Express now serves web/dist with an SPA fallback that skips /api so API
  misses still 404 cleanly.
- docker-compose.yml is a single-service deploy with a named volume for
  the SQLite database at /data/apothecary.db.
- .gitea/workflows/build.yml pushes :latest, :<sha>, and :semver tags to
  the Gitea container registry on main and v* tags.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/src/index.ts

@@ -1,3 +1,5 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 import cors from "cors";
 import express from "express";
 import { seedIfEmpty } from "./seed.js";
@@ -5,6 +7,9 @@ import { bootstrapRouter } from "./routes/bootstrap.js";
 import { productsRouter } from "./routes/products.js";
 import { catalogRouter } from "./routes/catalog.js";
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PUBLIC_DIR = path.resolve(__dirname, "..", "public");
+
 seedIfEmpty();
 
 const app = express();
@@ -15,6 +20,12 @@ app.use("/api", bootstrapRouter);
 app.use("/api", productsRouter);
 app.use("/api", catalogRouter);
 
+app.use(express.static(PUBLIC_DIR));
+app.get("*", (req, res, next) => {
+  if (req.path.startsWith("/api")) return next();
+  res.sendFile(path.join(PUBLIC_DIR, "index.html"));
+});
+
 const PORT = Number(process.env.PORT ?? 4000);
 app.listen(PORT, () => {
   console.log(`[apothecary] api listening on http://localhost:${PORT}`);