chore(docker): add compose deployment

[lukyrys]

Summary

• Docker Compose deployment for backend + HTTPS frontend
• self-signed TLS generation and same-origin /ws proxy for browser frontend
• configurable bind mounts for config/storage/certs and Docker README
• frontend API URL helper/tests and local Vite /ws proxy for dev
• (commit 9517023d) Dockerfile builds checksum worker as a separate sidecar at /app/lish/checksum-worker.js to align with the runtime resolution model PR fix(app): ship checksum worker sidecar across all bundle formats #27 introduces

⚠️ Merge order: PR #27 must land first

This PR's Dockerfile produces /app/lish/checksum-worker.js next to /app/lish-backend,
but the backend on this branch still resolves the worker via the buggy
new URL('./lish/checksum-worker.js', import.meta.url).href path
(backend/src/app.ts:22), which evaluates to a /$bunfs/root/... virtual URL
in compiled binaries.

PR #27 (fix/checksum-worker-cross-platform-bundles) replaces that with
pathToFileURL(join(dirname(execPath), 'lish', 'checksum-worker.js')). Without
PR #27 merged first, the worker file is shipped but the backend cannot find it
at runtime — LISH creation will hang at 0% the same way it did pre-fix on Windows.

After PR #27 lands and this branch rebases on main, no further code changes
are needed here — the Dockerfile fix in 9517023d already produces the layout
PR #27's runtime expects.

Verification

• bun test tests/api-url.test.ts in frontend/ → 5 pass
• docker build -f docker/Dockerfile . → image contains /app/lish-backend (103 MB) and /app/lish/checksum-worker.js (759 B)
• Docker WebSocket RPC lishs.create from companion container reaches backend, but hangs as expected without PR fix(app): ship checksum worker sidecar across all bundle formats #27's worker URL fix on this branch (proves the dependency, not a defect of this PR)
• Earlier Docker checks on this branch: frontend build, svelte-check, backend/frontend compose build, HTTPS smoke