feat(serve): HTTP transport + hardened Docker image for secure public serving

Add an opt-in streamable-HTTP transport alongside the default stdio, so
familiar can be reached from a home lab over HTTPS behind a TLS reverse proxy.

- config.http_settings(): env-driven transport/host/port/path/token settings.
- serve.run(): dispatch stdio vs http; fail closed on a non-loopback bind
  without a bearer token (FAMILIAR_ALLOW_INSECURE_BIND escape hatch).
- server.build_http_auth(): FastMCP StaticTokenVerifier bearer gate; add an
  unauthenticated /healthz route for container/proxy probes.
- `familiar serve` CLI alias; clean exit on InsecureBind.
- docker/Dockerfile (multi-stage, non-root) + hardened docker-compose.yml
  (read-only rootfs, cap_drop ALL, no-new-privileges, Traefik TLS labels),
  .dockerignore, .env.example. Token store mounts at /data; writes off by default.
- .gitea/workflows/docker.yml: build + smoke-test, opt-in image publish.
- docs/deployment.md + README/CLAUDE.md notes; tests for settings, fail-closed
  validation, and the bearer verifier.

.gitea/workflows/docker.yml

@@ -0,0 +1,71 @@
+name: Docker
+
+# Build the container image and smoke-test it on every PR/push to main/dev.
+# Publishing is opt-in: set the repo variable PUSH_IMAGE=true and provide the
+# REGISTRY_* vars/secrets. Without them this only builds + smoke-tests (never
+# blocks a merge on registry access).
+on:
+  pull_request:
+    branches: [main, dev]
+  push:
+    branches: [main, dev]
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build image
+        run: docker build -f docker/Dockerfile -t familiar:ci .
+
+      - name: Smoke-test (/healthz responds, MCP requires a token)
+        run: |
+          set -e
+          docker run -d --name familiar-ci \
+            -e FAMILIAR_TRANSPORT=http \
+            -e FAMILIAR_HTTP_HOST=0.0.0.0 \
+            -e FAMILIAR_HTTP_PORT=8000 \
+            -e FAMILIAR_HTTP_AUTH_TOKEN=ci-smoke-token \
+            -p 8000:8000 familiar:ci
+          # Wait for the healthcheck endpoint.
+          for i in $(seq 1 30); do
+            if curl -fsS http://127.0.0.1:8000/healthz >/dev/null; then ok=1; break; fi
+            sleep 1
+          done
+          test "${ok:-0}" = "1" || { echo "healthz never came up"; docker logs familiar-ci; exit 1; }
+          echo "healthz OK"
+          # MCP endpoint must reject an unauthenticated call.
+          code=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:8000/mcp \
+            -H 'Content-Type: application/json' \
+            -H 'Accept: application/json, text/event-stream' \
+            -d '{"jsonrpc":"2.0","id":1,"method":"ping"}')
+          test "$code" = "401" || { echo "expected 401 without token, got $code"; docker logs familiar-ci; exit 1; }
+          echo "auth gate OK (401 without token)"
+
+      - name: Cleanup
+        if: always()
+        run: docker rm -f familiar-ci || true
+
+      - name: Log in to registry
+        if: >-
+          github.event_name == 'push' &&
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') &&
+          vars.PUSH_IMAGE == 'true'
+        run: |
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ vars.REGISTRY_HOST }}" \
+            -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Tag + push image
+        if: >-
+          github.event_name == 'push' &&
+          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') &&
+          vars.PUSH_IMAGE == 'true'
+        run: |
+          # main -> :latest, dev -> :dev, both also tagged with the commit SHA.
+          MOVING=$([ "${{ github.ref_name }}" = "main" ] && echo latest || echo dev)
+          SHA=$(echo "${{ github.sha }}" | cut -c1-12)
+          for tag in "$MOVING" "$SHA"; do
+            docker tag familiar:ci "${{ vars.REGISTRY_IMAGE }}:$tag"
+            docker push "${{ vars.REGISTRY_IMAGE }}:$tag"
+          done