Add container deployment: Dockerfile, compose, systemd unit, redeploy script

Multi-stage build (node -> go -> alpine) producing the static tefterd
binary with the frontend embedded. Compose follows the house style for
the podman/SELinux server (:Z volume label + label:disable). deploy/
holds the user systemd unit and redeploy-tefter.sh, mirroring the
apelacija setup.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,33 @@
+# Build the frontend bundle (vite), then the static tefterd binary that
+# embeds it, then ship binary-only. VERSION flows in from compose
+# (${TEFTER_VERSION}) so `tefterd version` matches the git describe.
+
+# Fully-qualified images (podman enforces short-name resolution non-interactively).
+FROM docker.io/library/node:22-alpine AS frontend
+WORKDIR /src/frontend
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY frontend/ ./
+ARG VERSION=dev
+RUN TEFTER_VERSION=$VERSION npx vite build
+
+FROM docker.io/library/golang:1.25-alpine AS build
+WORKDIR /src/server
+COPY server/go.mod server/go.sum ./
+RUN go mod download
+COPY server/ ./
+# go:embed cannot reach outside the module dir, so the bundle is copied in
+# (same as the Makefile does).
+COPY --from=frontend /src/frontend/dist ./webdist/dist
+ARG VERSION=dev
+RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=$VERSION" -o /tefterd .
+
+FROM docker.io/library/alpine:3.22
+RUN adduser -D -H tefter && mkdir -p /data && chown tefter /data
+COPY --from=build /tefterd /usr/local/bin/tefterd
+USER tefter
+ENV TEFTER_DB=/data/tefter.db
+# The auth token is generated and printed to the logs on first start.
+EXPOSE 8420
+VOLUME /data
+CMD ["tefterd"]