Add Makefile dev/test/docker targets and multi-stage Dockerfile

Makefile: dev runs the Go server (:8080) and Vite (:5173) together and
stops both on Ctrl-C; test runs the gofmt check, go vet, go test -race and
npm ci/typecheck/test; build stamps the version via -ldflags into a static
CGO_ENABLED=0 binary; docker builds the root Dockerfile. VERSION defaults
to git describe with a dev fallback.

Dockerfile: digest-pinned Node 22, Go 1.25 and Alpine 3.22 stages; the
runtime runs as uid 10001 with /data as a volume, EXPOSE 8080 and a
HEALTHCHECK on /health. .dockerignore keeps VCS, design, dependencies,
build output, databases and secrets out of the context.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,20 @@
+# Keep the build context small and free of secrets and local state.
+.git
+.gitignore
+.dockerignore
+Dockerfile
+.remember/
+.claude/
+design/
+**/.DS_Store
+node_modules
+web/node_modules
+web/dist
+bin/
+*.db
+*.db-*
+.env*
+**/.env*
+deploy/secrets/
+*.pem
+*.key