Publish the native release as a container image and document deployment

A static nginx image (unprivileged, read-only) of the production build,
published to Gitea's registry for amd64 and arm64: version tags go to
prod, manual dev-<commit> builds to dev, each smoke-tested first and
optionally announced to Dockhand. The README describes running it with
Docker Compose.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/nginx.conf

@@ -0,0 +1,20 @@
+server {
+    listen 8080;
+    listen [::]:8080;
+    server_name _;
+    root /srv/crystal;
+    index index.html;
+
+    # Revalidate the shell and service worker so installed apps see updates.
+    add_header Cache-Control "no-cache" always;
+
+    # Vite fingerprints these files; their URLs change with their content.
+    location /assets/ {
+        add_header Cache-Control "public, max-age=31536000, immutable";
+        try_files $uri =404;
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}