feat(serve): HTTP transport + hardened Docker image for secure public serving

Add an opt-in streamable-HTTP transport alongside the default stdio, so
familiar can be reached from a home lab over HTTPS behind a TLS reverse proxy.

- config.http_settings(): env-driven transport/host/port/path/token settings.
- serve.run(): dispatch stdio vs http; fail closed on a non-loopback bind
  without a bearer token (FAMILIAR_ALLOW_INSECURE_BIND escape hatch).
- server.build_http_auth(): FastMCP StaticTokenVerifier bearer gate; add an
  unauthenticated /healthz route for container/proxy probes.
- `familiar serve` CLI alias; clean exit on InsecureBind.
- docker/Dockerfile (multi-stage, non-root) + hardened docker-compose.yml
  (read-only rootfs, cap_drop ALL, no-new-privileges, Traefik TLS labels),
  .dockerignore, .env.example. Token store mounts at /data; writes off by default.
- .gitea/workflows/docker.yml: build + smoke-test, opt-in image publish.
- docs/deployment.md + README/CLAUDE.md notes; tests for settings, fail-closed
  validation, and the bearer verifier.

.dockerignore

@@ -0,0 +1,36 @@
+# Keep the build context small and free of secrets / local state.
+.git
+.gitea
+.venv
+venv
+env
+ENV
+__pycache__
+*.py[cod]
+*.egg-info
+build
+dist
+downloads
+wheels
+.pytest_cache
+.ruff_cache
+.mypy_cache
+htmlcov
+.coverage
+.coverage.*
+coverage.xml
+.cache
+
+# Secrets / local config — never bake into an image.
+.env
+.env.*
+!.env.example
+
+# Local docs site / editor cruft
+site
+.idea
+.vscode
+
+# Never ship the encrypted token store or audit log into the image.
+data
+*.enc