Publish the native release as a container image and document deployment

A static nginx image (unprivileged, read-only) of the production build,
published to Gitea's registry for amd64 and arm64: version tags go to
prod, manual dev-<commit> builds to dev, each smoke-tested first and
optionally announced to Dockhand. The README describes running it with
Docker Compose.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,19 @@
+# syntax=docker/dockerfile:1
+
+# The output is static, so both target architectures share a native build.
+FROM --platform=$BUILDPLATFORM node:22-alpine AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY tsconfig.json vite.config.ts index.html ./
+COPY src/ ./src/
+COPY public/ ./public/
+COPY scripts/service-worker.mjs scripts/check-release.mjs ./scripts/
+RUN npm run build && npm run check:release
+
+FROM nginxinc/nginx-unprivileged:stable-alpine AS runtime
+COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/dist/ /srv/crystal/
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget -q -O /dev/null http://127.0.0.1:8080/ || exit 1