feat(docker): add Dockerfile, Docker Compose, and deployment entrypoint

Multi-stage Dockerfile produces a lean image with the compiled SvelteKit
app (adapter-node) and the MCP server TypeScript source. A single image
supports two run modes selected via CMD: web (default) and mcp.

- docker-entrypoint.sh handles CA certificate install (PEM/DER auto-detected
  via openssl), SSH key permission fix for Windows-mounted keys, per-host
  HTTPS credential helpers for Bitbucket and GitLab, DB migrations, then
  starts the requested service
- docker-compose.yml runs web on :3000 and the MCP HTTP server on :3001,
  with the MCP container pointed at the web service via internal DNS
- .dockerignore excludes node_modules, build output, .env files, and *.db*

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,25 @@
+services:
+  web:
+    build: .
+    ports:
+      - "3000:3000"
+    volumes:
+      - trueref-data:/data
+    environment:
+      DATABASE_URL: /data/trueref.db
+    restart: unless-stopped
+
+  mcp:
+    build: .
+    command: mcp
+    ports:
+      - "3001:3001"
+    environment:
+      TRUEREF_API_URL: http://web:3000
+      MCP_PORT: "3001"
+    depends_on:
+      - web
+    restart: unless-stopped
+
+volumes:
+  trueref-data: