Backend Phase A: foundation, migrations, Docker setup

- Go backend skeleton: config (caarlos0/env), slog JSON logging,
  pgxpool store, HTTP server with graceful shutdown.
- httpapi: render helpers, Problem errors, middleware chain
  (requestID / logging / recover / CORS), /healthz and /readyz.
- Migrations: full initial schema (users, sessions, lists,
  list_members, items, op_log SOURCE OF TRUTH, item_names) +
  golang-migrate runner binary using source/iofs (embedded).
- Docker: multi-stage Dockerfile (Go 1.26 -> distroless nonroot),
  builds both server and migrate binaries.
- deploy: docker-compose (caddy + backend + migrate + postgres:16),
  Caddyfile (auto-HTTPS), .env.example, pg extensions init script.
- AGENTS.md: project context + roadmap for AI agents.

Verified: image builds, both binaries run in container (smoke test).

backend/Dockerfile

@@ -0,0 +1,33 @@
+# syntax=docker/dockerfile:1
+
+# ---- build stage ----
+FROM golang:1.26-alpine AS builder
+WORKDIR /src
+
+# Cache deps first.
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+# Build both binaries statically (pgx speaks the wire protocol, no cgo needed).
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -ldflags="-s -w" -trimpath \
+    -o /out/server ./cmd/server && \
+    CGO_ENABLED=0 GOOS=linux go build \
+    -ldflags="-s -w" -trimpath \
+    -o /out/migrate ./cmd/migrate
+
+# ---- runtime stage ----
+# distroless/static ships CA certificates (needed for OIDC JWKS over HTTPS)
+# and a nonroot user.
+FROM gcr.io/distroless/static-debian12:nonroot
+WORKDIR /app
+COPY --from=builder /out/server /app/server
+COPY --from=builder /out/migrate /app/migrate
+
+# The API server runs by default. The one-shot migrate job overrides the
+# command in docker-compose to "/app/migrate up".
+USER nonroot:nonroot
+EXPOSE 8080
+ENTRYPOINT ["/app/server"]