chore(server): container, compose, and the Pi deployment notes

compose.yaml joins the Pi's existing network as external and reaches the
Postgres and Caddy already there by name; nothing is published to the
host. The schema applies itself on boot, so there is no migration step to
run by hand.

The Caddy snippet in the README is the part worth reading. Excluding
/api/tutor from `encode` matters more than flush_interval: compression
delays the header flush until body bytes arrive and holds already-flushed
events inside an unfinished frame, which presents as a stream that hangs
rather than as an error.

Untested against the actual Pi — written from PORT.md and verified only
as far as building the image and running it against a local Postgres.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/Dockerfile

@@ -0,0 +1,26 @@
+# Node 22 runs TypeScript directly with --experimental-strip-types, so there
+# is no build step and no compiled artefact to keep in sync with the source.
+FROM node:22-alpine
+
+WORKDIR /app
+
+# Workspace manifests first, so a dependency change is the only thing that
+# busts the install layer.
+COPY package.json package-lock.json ./
+COPY server/package.json ./server/
+RUN npm ci --omit=dev --workspace @hankan/server --include-workspace-root
+
+# shared/ is imported by both the app and the server; the server needs the
+# sync protocol at runtime.
+COPY shared ./shared
+COPY server ./server
+
+ENV NODE_ENV=production
+ENV PORT=8787
+EXPOSE 8787
+
+# The health route needs no token, precisely so this can reach it.
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
+  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||8787)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["node", "--experimental-strip-types", "server/src/main.ts"]