Add Docker Compose setup with persistent volume

Improve the production Dockerfile (healthcheck, entrypoint bootstrap
user, pruned deps) and add docker-compose.yml plus .dockerignore for
one-command deploy with a named SQLite volume.

README.md

@@ -86,16 +86,46 @@ GitHub Actions runs lint, typecheck, and tests on every pull request and push to
 
 ## Docker
 
+### docker compose (recommended)
+
+```bash
+cp .env.example .env
+# set AUTH_SECRET to a long random string
+
+# optional first user on boot:
+# echo '[email protected]' >> .env
+# echo 'CREATE_USER_PASSWORD=changeme' >> .env
+
+docker compose up -d --build
+```
+
+App: http://localhost:3000 — SQLite persists in the `rfid-data` volume.
+
+Create a user later (if you skipped bootstrap):
+
+```bash
+docker compose exec rfid-database \
+  npx tsx scripts/create-user.ts --email [email protected] --password 'secret' --name You
+```
+
+Stop / remove (keeps volume):
+
+```bash
+docker compose down
+```
+
+### Plain docker
+
 ```bash
 docker build -t rfid-database .
 docker run --rm -p 3000:3000 \
   -e AUTH_SECRET=your-long-secret \
+  -e CREATE_USER_EMAIL=[email protected] \
+  -e CREATE_USER_PASSWORD=changeme \
   -v rfid-data:/data \
   rfid-database
 ```
 
-Create the first user against the mounted DB (exec into the container or run `create-user` with `RFID_DB_PATH` pointed at the volume).
-
 ## Security
 
 Tag dumps often include sector keys. Keep the app behind HTTPS, do not expose it publicly without auth, and treat `data/rfid.db` as sensitive.