Docker image + docker-compose (one-command self-host)

[JSONbored]

Part of #975.

Context

Package the whole self-host stack so a maintainer can run it with one command.

Deliverables

• A Dockerfile for the Node self-host runtime; a published image.
• A docker-compose.yml that brings up the app + default OSS infra (relational store, queue, etc.) and (optionally) the dashboard.
• Env/file-based configuration; container healthchecks; volumes for persistence and for the AI credential (mounted as a secret).
• A quickstart path: clone → configure → docker compose up → automation running against a test repo.
• Multi-arch image (amd64/arm64) if feasible.

Acceptance criteria

• A maintainer with Docker can self-host end-to-end in minutes using documented defaults, with no managed cloud services.
• The credential/secret is mounted, not baked into the image.

Sub-issues

• selfhost(docker): Docker Compose profiles for optional services #1199 — Docker Compose profiles for optional services (Caddy, PgBouncer, Redis, Ollama, Litestream, Tailscale, runners, observability)
• selfhost(docker): Caddy HTTPS terminator with auto-TLS #1203 — Caddy HTTPS terminator with auto-TLS
• selfhost(docker): Tailscale sidecar — tailnet-native access without exposed ports #1204 — Tailscale sidecar — tailnet-native access without exposed ports
• selfhost(docker): self-hosted GitHub Actions runner in compose stack #1205 — self-hosted GitHub Actions runner in compose stack