feat(docker): add single-image multi-stage Docker setup with compose

- Multi-stage build: Node builds the frontend, Go builds a static
  CGO-free binary, runtime is Alpine with CA certificates
- Add docker-compose.yml with persistent volume for the SQLite database
- Add .dockerignore to keep the build context slim
- Embed time/tzdata in the Go binary for OS-independent timezones
- Document image build, startup, secrets, and reverse-proxy setup in README

Dockerfile

@@ -0,0 +1,45 @@
+# ──────────────────────────────────────────────────────────────────────
+# WannPassts – Multi-Stage-Build: Frontend + Backend in einem Image
+# Bauen:  docker build -t wannpassts .
+# Starten: docker run -p 8080:8080 -v wannpassts-data:/data wannpassts
+# ──────────────────────────────────────────────────────────────────────
+
+# ── Stage 1: Frontend bauen ───────────────────────────────────────────
+FROM node:22-alpine AS frontend
+WORKDIR /build
+# Dependencies zuerst (besserer Layer-Cache)
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+COPY frontend/ ./
+RUN npm run build
+
+# ── Stage 2: Backend bauen (CGO-frei → statisches Binary) ────────────
+# go.mod verlangt Go >= 1.25 (modernc.org/sqlite)
+FROM golang:1.25-alpine AS backend
+WORKDIR /build
+COPY backend/go.mod backend/go.sum ./
+RUN go mod download
+COPY backend/ ./
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/wannpassts ./cmd/server
+
+# ── Stage 3: Laufzeit ─────────────────────────────────────────────────
+FROM alpine:3.20
+# ca-certificates: nötig für HTTPS zu Google/CalDAV/ICS-Servern
+RUN apk add --no-cache ca-certificates tzdata \
+    && adduser -D -H -u 1000 app \
+    && mkdir -p /data && chown -R app:app /data
+WORKDIR /app
+COPY --from=backend /out/wannpassts ./wannpassts
+COPY --from=frontend /build/dist ./dist
+
+USER app
+ENV PORT=8080 \
+    DB_PATH=/data/wannpassts.db \
+    STATIC_DIR=/app/dist \
+    APP_URL=http://localhost:8080 \
+    FRONTEND_URL=http://localhost:8080
+VOLUME /data
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+  CMD wget -qO- http://127.0.0.1:8080/api/health || exit 1
+ENTRYPOINT ["/app/wannpassts"]