feat(deploy): containerize api + web for single-host docker-compose

- apps/api/Dockerfile: multi-stage build, runs prisma migrate deploy on
  boot. Workspace package.json "main/exports" rewritten to dist so Node
  ESM resolves compiled JS at runtime.
- apps/web/Dockerfile + nginx.conf: static build served by nginx with
  SPA fallback, gzip, cache-bust on hashed assets, and /api reverse
  proxy to the internal api service.
- docker-compose.yml: production-oriented stack — api (SQLite on a
  named volume), web (exposes WEB_PORT), redis (for the upcoming
  worker). Postgres dropped since schema still targets SQLite.
- .dockerignore: keep build context lean.
- ci: add docker job gated on push-to-main that builds and pushes both
  images to ${{ vars.REGISTRY_URL }} using ${{ secrets.REGISTRY_TOKEN }}.
  Tags :latest + :${github.sha}.

.dockerignore

@@ -0,0 +1,28 @@
+**/node_modules
+**/dist
+**/.turbo
+**/coverage
+**/tsconfig.tsbuildinfo
+
+# env + local files
+**/.env
+**/.env.*.local
+**/*.local
+
+# VCS + tooling
+.git
+.gitea
+.github
+.claude
+.vscode
+.idea
+
+# playwright artifacts
+apps/e2e/test-results
+apps/e2e/playwright-report
+
+# logs + local databases
+**/*.log
+**/dev.db
+**/dev.db-journal
+