feat(docker): add Dockerfile, Docker Compose, and deployment entrypoint

Multi-stage Dockerfile produces a lean image with the compiled SvelteKit
app (adapter-node) and the MCP server TypeScript source. A single image
supports two run modes selected via CMD: web (default) and mcp.

- docker-entrypoint.sh handles CA certificate install (PEM/DER auto-detected
  via openssl), SSH key permission fix for Windows-mounted keys, per-host
  HTTPS credential helpers for Bitbucket and GitLab, DB migrations, then
  starts the requested service
- docker-compose.yml runs web on :3000 and the MCP HTTP server on :3001,
  with the MCP container pointed at the web service via internal DNS
- .dockerignore excludes node_modules, build output, .env files, and *.db*

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+
+case "${1:-web}" in
+  web)
+    echo "Running database migrations..."
+    DATABASE_URL="$DATABASE_URL" npx drizzle-kit migrate
+    echo "Starting TrueRef web app on port ${PORT:-3000}..."
+    exec node build
+    ;;
+  mcp)
+    MCP_PORT="${MCP_PORT:-3001}"
+    echo "Starting TrueRef MCP HTTP server on port ${MCP_PORT}..."
+    exec npx tsx src/mcp/index.ts --transport http --port "$MCP_PORT"
+    ;;
+  *)
+    exec "$@"
+    ;;
+esac