feat: add production container image

[HoungDev]

Summary

• add a multi-stage production image built from the locked runtime dependency set
• run the final image as UID/GID 10001 without uv, test dependencies, the source checkout, or environment files
• extend Compose with a one-shot migration service and a hardened API service
• add CI checks that build and run the image against PostgreSQL, verify non-root identity, and smoke-test liveness/readiness
• add a stack-up development command, Docker Dependabot coverage, and deployment/release documentation

Security and operations model

The container starts one Uvicorn process and expects migrations to run as a separate release task. The documented runtime uses a read-only root filesystem, a writable /tmp tmpfs, no Linux capabilities, and no-new-privileges. The image healthcheck uses liveness so a dependency outage does not cause a restart loop; readiness remains the traffic-admission signal.

Validation

• ruff format --check .
• ruff check .
• 12 focused helper/container-file tests passed locally
• full Docker build, runtime identity check, PostgreSQL readiness smoke test, full suite, audit, and package checks delegated to GitHub Actions