feat(docker): image, compose, and env for remote-HTTP deployment

- docker/Dockerfile: multi-stage uv wheel build; runtime runs `familiar serve`
  as a non-root user (uid 1000) on port 8080, /data volume for the encrypted
  token store, and a HEALTHCHECK against /healthz. No token is baked in — serve
  refuses to start without FAMILIAR_HTTP_TOKEN, so it's supplied at run time.
- docker-compose.yml: joins an external `proxy` network (Traefik labels for TLS,
  nginx/Caddy documented as alternatives), read-only rootfs, tmpfs /tmp,
  no-new-privileges, cap_drop ALL, non-root, /healthz healthcheck. Pulls the
  published FAMILIAR_IMAGE with a local build as fallback; writes default off.
- .env.example: every FAMILIAR_* knob incl. the bearer token, auth mode, the
  OAuth resource-server settings, and the insecure-bind escape hatch.
- .dockerignore: keep local state (data/, *.enc, key) and dev files out.

.dockerignore

@@ -0,0 +1,26 @@
+# Keep the build context small and never ship local state or secrets.
+.git
+.gitea
+.venv
+**/__pycache__/
+*.pyc
+.pytest_cache
+.ruff_cache
+.coverage
+htmlcov
+dist
+build
+*.egg-info
+
+# Local EVE token store / data dir — must never end up in an image layer.
+data
+*.enc
+key
+
+# Docs, tests, and dev tooling aren't needed at runtime.
+tests
+doc
+docker-compose.yml
+.env
+.env.*
+!.env.example