chore(devops): docker-compose dev + prod, Dockerfiles, nginx, Makefile

- backend/Dockerfile: Python 3.12 slim, non-root user, WeasyPrint system deps
- backend/Dockerfile.dev: dev variant with hot-reload support
- frontend/Dockerfile: Node 20 alpine build + nginx:alpine serve
- frontend/nginx.conf: SPA routing + /api proxy to backend:8000
- docker-compose.yml: production with healthcheck
- docker-compose.dev.yml: dev with volume mounts and hot-reload
- Makefile: dev, build, up, down, logs, migrate, test, shell, prod targets
- .dockerignore for backend and frontend

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/.dockerignore

@@ -0,0 +1,11 @@
+__pycache__
+*.pyc
+*.pyo
+.pytest_cache
+.env
+data/*.db
+data/backup-*
+.git
+.gitignore
+tests/
+*.md

backend/Dockerfile

@@ -0,0 +1,20 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y \
+    libpango-1.0-0 libpangoft2-1.0-0 libpangocairo-1.0-0 \
+    libgdk-pixbuf2.0-0 libcairo2 curl \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN useradd -m -s /bin/bash appuser
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+RUN chown -R appuser:appuser /app
+USER appuser
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]

backend/Dockerfile.dev

@@ -0,0 +1,20 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y \
+    libpango-1.0-0 libpangoft2-1.0-0 libpangocairo-1.0-0 \
+    libgdk-pixbuf2.0-0 libcairo2 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN useradd -m -s /bin/bash appuser
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+RUN chown -R appuser:appuser /app
+USER appuser
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]