feat(docker): add single-image multi-stage Docker setup with compose

- Multi-stage build: Node builds the frontend, Go builds a static
  CGO-free binary, runtime is Alpine with CA certificates
- Add docker-compose.yml with persistent volume for the SQLite database
- Add .dockerignore to keep the build context slim
- Embed time/tzdata in the Go binary for OS-independent timezones
- Document image build, startup, secrets, and reverse-proxy setup in README

docker-compose.yml

@@ -0,0 +1,23 @@
+services:
+  wannpassts:
+    build: .
+    image: wannpassts
+    container_name: wannpassts
+    restart: unless-stopped
+    ports:
+      - "8080:8080"
+    # Secrets und Google-Zugangsdaten: backend/.env anlegen
+    # (cp backend/.env.example backend/.env) und Kommentar entfernen:
+    # env_file: backend/.env
+    environment:
+      APP_URL: ${APP_URL:-http://localhost:8080}
+      FRONTEND_URL: ${FRONTEND_URL:-http://localhost:8080}
+      JWT_SECRET: ${JWT_SECRET:-}
+      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-}
+      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
+      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
+    volumes:
+      - wannpassts-data:/data
+
+volumes:
+  wannpassts-data: