feat(docker): image, compose, and env for remote-HTTP deployment

- docker/Dockerfile: multi-stage uv wheel build; runtime runs `familiar serve`
  as a non-root user (uid 1000) on port 8080, /data volume for the encrypted
  token store, and a HEALTHCHECK against /healthz. No token is baked in — serve
  refuses to start without FAMILIAR_HTTP_TOKEN, so it's supplied at run time.
- docker-compose.yml: joins an external `proxy` network (Traefik labels for TLS,
  nginx/Caddy documented as alternatives), read-only rootfs, tmpfs /tmp,
  no-new-privileges, cap_drop ALL, non-root, /healthz healthcheck. Pulls the
  published FAMILIAR_IMAGE with a local build as fallback; writes default off.
- .env.example: every FAMILIAR_* knob incl. the bearer token, auth mode, the
  OAuth resource-server settings, and the insecure-bind escape hatch.
- .dockerignore: keep local state (data/, *.enc, key) and dev files out.

.env.example

@@ -0,0 +1,46 @@
+# familiar — remote HTTP / Docker deployment settings.
+# Copy to .env and fill in. .env is gitignored; never commit real secrets.
+
+# --- Image (published to Gitea by .gitea/workflows/docker.yml) -------------- #
+# Prod channel: :latest or :main. Dev channel: :dev. Or pin :sha-<12>.
+FAMILIAR_IMAGE=git.hiddenden.cafe/hiddenden/familiar:latest
+
+# --- Bind + path ----------------------------------------------------------- #
+# The image binds 0.0.0.0:8080 internally; only the reverse proxy reaches it.
+# FAMILIAR_HTTP_PATH must match your proxy's location block.
+FAMILIAR_HTTP_PATH=/mcp
+
+# --- Auth mode ------------------------------------------------------------- #
+# bearer (default) — a single static token (below). Works with every client.
+# oauth  — validate external-issuer JWTs; needed only for the Claude web
+#          connector (requires an external IdP with DCR). See doc/clients/claude-web.md.
+FAMILIAR_AUTH_MODE=bearer
+
+# --- Bearer auth (REQUIRED when FAMILIAR_AUTH_MODE=bearer) ------------------ #
+# Token clients send as `Authorization: Bearer <token>`. Generate a strong one:
+#   openssl rand -hex 32
+FAMILIAR_HTTP_TOKEN=
+
+# Escape hatch: allow a public (0.0.0.0) bind with NO token. Leave false unless
+# authentication is handled entirely upstream.
+# FAMILIAR_ALLOW_INSECURE_BIND=false
+
+# --- OAuth 2.1 resource server (only when FAMILIAR_AUTH_MODE=oauth) --------- #
+# FAMILIAR_OAUTH_ISSUER=https://idp.example.com/application/o/familiar/
+# FAMILIAR_OAUTH_RESOURCE=https://familiar.example.com   # this server's public URL
+# FAMILIAR_OAUTH_AUDIENCE=https://familiar.example.com   # defaults to RESOURCE
+# FAMILIAR_OAUTH_JWKS_URI=                               # optional; else discovered from issuer
+
+# --- Data / writes --------------------------------------------------------- #
+# Host path holding the encrypted token store (token.enc + key), audit log, and
+# write toggle. Produced by `familiar login` on a machine with a browser (or
+# `familiar login --no-browser` on the host).
+FAMILIAR_DATA_DIR_HOST=./data
+
+# Writes off by default on a public instance. Set true to allow guarded writes.
+FAMILIAR_ENABLE_WRITES=false
+
+# --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
+# Only used if you run Traefik. For nginx/Caddy, see doc/deployment.md.
+FAMILIAR_DOMAIN=familiar.example.com
+TRAEFIK_CERTRESOLVER=letsencrypt