feat(deploy): containerize api + web for single-host docker-compose

- apps/api/Dockerfile: multi-stage build, runs prisma migrate deploy on
  boot. Workspace package.json "main/exports" rewritten to dist so Node
  ESM resolves compiled JS at runtime.
- apps/web/Dockerfile + nginx.conf: static build served by nginx with
  SPA fallback, gzip, cache-bust on hashed assets, and /api reverse
  proxy to the internal api service.
- docker-compose.yml: production-oriented stack — api (SQLite on a
  named volume), web (exposes WEB_PORT), redis (for the upcoming
  worker). Postgres dropped since schema still targets SQLite.
- .dockerignore: keep build context lean.
- ci: add docker job gated on push-to-main that builds and pushes both
  images to ${{ vars.REGISTRY_URL }} using ${{ secrets.REGISTRY_TOKEN }}.
  Tags :latest + :${github.sha}.

docker-compose.yml

@@ -1,28 +1,66 @@
+# Vector — single-instance production deployment.
+#
+# Quick start:
+#   1. Create a .env file next to this compose file containing at minimum:
+#        JWT_SECRET=<64+ char random hex>
+#        CLIENT_ORIGIN=http://your-host:8080
+#        WEB_PORT=8080
+#      For registry-pushed images (optional):
+#        REGISTRY_URL=registry.example.com/josh
+#        TAG=latest
+#
+#   2. Bring up the stack:
+#        docker compose up -d --build
+#      or pull pre-built images from the registry:
+#        docker compose pull && docker compose up -d
+#
+# Data lives in the `vector-data` volume (SQLite db). Redis is included
+# in anticipation of the BullMQ worker follow-up; the API does not yet
+# depend on it.
+
+x-restart: &restart
+  restart: unless-stopped
+
 services:
-  postgres:
-    image: postgres:16-alpine
-    container_name: vector-postgres
-    restart: unless-stopped
+  api:
+    <<: *restart
+    image: ${REGISTRY_URL:-vector}/vector-api:${TAG:-latest}
+    build:
+      context: .
+      dockerfile: apps/api/Dockerfile
     environment:
-      POSTGRES_USER: vector
-      POSTGRES_PASSWORD: vector
-      POSTGRES_DB: vector
-    ports:
-      - "5432:5432"
+      NODE_ENV: production
+      PORT: 3001
+      DATABASE_URL: file:/data/vector.db
+      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required — see .env.example}
+      CLIENT_ORIGIN: ${CLIENT_ORIGIN:-http://localhost:8080}
     volumes:
-      - vector-pgdata:/var/lib/postgresql/data
+      - vector-data:/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U vector -d vector"]
-      interval: 5s
+      test: ["CMD-SHELL", "wget -qO- http://localhost:3001/healthz || exit 1"]
+      interval: 30s
       timeout: 5s
-      retries: 10
+      retries: 3
+      start_period: 20s
+    depends_on:
+      redis:
+        condition: service_healthy
+
+  web:
+    <<: *restart
+    image: ${REGISTRY_URL:-vector}/vector-web:${TAG:-latest}
+    build:
+      context: .
+      dockerfile: apps/web/Dockerfile
+    ports:
+      - "${WEB_PORT:-8080}:80"
+    depends_on:
+      api:
+        condition: service_healthy
 
   redis:
+    <<: *restart
     image: redis:7-alpine
-    container_name: vector-redis
-    restart: unless-stopped
-    ports:
-      - "6379:6379"
     volumes:
       - vector-redisdata:/data
     healthcheck:
@@ -32,5 +70,5 @@ services:
       retries: 10
 
 volumes:
-  vector-pgdata:
+  vector-data:
   vector-redisdata: