feat(serve): HTTP transport + hardened Docker image for secure public serving

Add an opt-in streamable-HTTP transport alongside the default stdio, so
familiar can be reached from a home lab over HTTPS behind a TLS reverse proxy.

- config.http_settings(): env-driven transport/host/port/path/token settings.
- serve.run(): dispatch stdio vs http; fail closed on a non-loopback bind
  without a bearer token (FAMILIAR_ALLOW_INSECURE_BIND escape hatch).
- server.build_http_auth(): FastMCP StaticTokenVerifier bearer gate; add an
  unauthenticated /healthz route for container/proxy probes.
- `familiar serve` CLI alias; clean exit on InsecureBind.
- docker/Dockerfile (multi-stage, non-root) + hardened docker-compose.yml
  (read-only rootfs, cap_drop ALL, no-new-privileges, Traefik TLS labels),
  .dockerignore, .env.example. Token store mounts at /data; writes off by default.
- .gitea/workflows/docker.yml: build + smoke-test, opt-in image publish.
- docs/deployment.md + README/CLAUDE.md notes; tests for settings, fail-closed
  validation, and the bearer verifier.

.env.example

@@ -0,0 +1,33 @@
+# familiar — HTTP / Docker deployment settings.
+# Copy to .env and fill in. `.env` is gitignored; never commit real secrets.
+
+# --- Transport ------------------------------------------------------------- #
+# stdio (default, local) or http (Docker / public). The image sets http.
+FAMILIAR_TRANSPORT=http
+
+# Bind + path. In Docker the container binds 0.0.0.0 internally; the reverse
+# proxy is the only thing that reaches it. Leave HTTP_HOST unset locally to keep
+# the safe 127.0.0.1 default.
+# FAMILIAR_HTTP_HOST=0.0.0.0
+FAMILIAR_HTTP_PORT=8000
+FAMILIAR_HTTP_PATH=/mcp
+
+# --- Auth (REQUIRED for any non-loopback bind) ----------------------------- #
+# Bearer token clients must send as `Authorization: Bearer <token>`.
+# Generate a strong one, e.g.:  python -c "import secrets; print(secrets.token_urlsafe(32))"
+FAMILIAR_HTTP_AUTH_TOKEN=
+
+# Escape hatch to bind a public interface WITHOUT a token. Leave false.
+# FAMILIAR_ALLOW_INSECURE_BIND=false
+
+# --- Data / writes --------------------------------------------------------- #
+# Host path holding the encrypted token store (token.enc + key), audit log, and
+# write toggle. Produced by `familiar login` on a machine with a browser.
+FAMILIAR_DATA_DIR_HOST=./data
+
+# Writes off by default on a public instance. Set true to allow guarded writes.
+FAMILIAR_ENABLE_WRITES=false
+
+# --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
+FAMILIAR_DOMAIN=familiar.example.com
+TRAEFIK_CERTRESOLVER=letsencrypt