Add Docker Compose setup with persistent volume

Improve the production Dockerfile (healthcheck, entrypoint bootstrap
user, pruned deps) and add docker-compose.yml plus .dockerignore for
one-command deploy with a named SQLite volume.

docker/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -e
+
+if [ -z "$AUTH_SECRET" ] || [ "$AUTH_SECRET" = "change-me-to-a-long-random-string" ]; then
+  echo "ERROR: AUTH_SECRET must be set to a long random value." >&2
+  exit 1
+fi
+
+mkdir -p "$(dirname "${RFID_DB_PATH:-/data/rfid.db}")"
+
+# Optional first-boot user: set CREATE_USER_EMAIL + CREATE_USER_PASSWORD
+if [ -n "$CREATE_USER_EMAIL" ] && [ -n "$CREATE_USER_PASSWORD" ]; then
+  echo "Ensuring user $CREATE_USER_EMAIL exists (ignored if already present)..."
+  npx tsx scripts/create-user.ts \
+    --email "$CREATE_USER_EMAIL" \
+    --password "$CREATE_USER_PASSWORD" \
+    --name "${CREATE_USER_NAME:-Admin}" \
+    || true
+fi
+
+exec "$@"