feat(docker): add multi-stage image and compose with persistent SQLite

Mount ./docker-data for WAL-capable SQLite storage, support DATABASE_PATH alias, and document compose secrets via .env.docker.example.

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -0,0 +1,53 @@
+# syntax=docker/dockerfile:1
+
+FROM node:22.12.0-bookworm-slim AS builder
+
+WORKDIR /app
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends python3 make g++ \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY package.json package-lock.json ./
+
+RUN npm ci
+
+COPY nest-cli.json tsconfig.json tsconfig.build.json ./
+COPY src ./src
+
+RUN npm run build
+
+FROM node:22.12.0-bookworm-slim AS production
+
+WORKDIR /app
+
+ENV NODE_ENV=production \
+    PORT=3000 \
+    HOST=0.0.0.0 \
+    DB_PATH=/app/data/app.db
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends python3 make g++ \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY package.json package-lock.json ./
+
+RUN npm ci --omit=dev \
+  && npm rebuild better-sqlite3 \
+  && apt-get purge -y python3 make g++ \
+  && apt-get autoremove -y \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /app/dist ./dist
+
+RUN mkdir -p /app/data \
+  && chown -R node:node /app
+
+USER node
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:3000/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["node", "dist/main.js"]