feat(compose): full-stack Caddy + docker-compose wiring

Brings up the whole platform behind a single Caddy entrypoint so the
routing topology can be exercised end-to-end before any feature code
lands. Same Caddyfile shape (admin / data plane / dashboard) maps to
single-process MVP today and will map to cluster mode later by
swapping the upstream lists, not by restructuring the proxy.

  * caddy/Caddyfile — dev: HTTP only, picloud and dashboard upstreams
    by service name. caddy/Caddyfile.prod — Let's Encrypt for
    PICLOUD_DOMAIN with PICLOUD_ADMIN_EMAIL.
  * docker/orchestrator.Dockerfile — multi-stage build of the
    `picloud` all-in-one against the pinned 1.92 toolchain; debian
    slim runtime, non-root user, /healthz HEALTHCHECK.
  * docker/dashboard.Dockerfile — node:24-alpine builder + caddy
    runtime that serves the static SPA with SPA fallback.
  * docker-compose.yml — postgres + picloud + dashboard + caddy,
    Caddy exposed on host :8000 (configurable), Postgres on :15432
    (loopback only). Health-gated startup ordering.
  * docker-compose.prod.yml — overlay: removes Postgres host
    mapping, expands Caddy to 80/443/443udp, swaps Caddyfile.prod,
    adds restart policy.
  * .env.example documents every knob the compose stack reads.

Verified via `docker compose up -d`:
  * `curl :8000/healthz` → 200 ok (orchestrator)
  * `curl :8000/api/admin/scripts` → 404 (manager, routed correctly)
  * `curl :8000/api/execute/<id>` → 404 (orchestrator, routed correctly)
  * `curl :8000/` → SPA index served (dashboard via Caddy)
  * `curl :8000/favicon.svg` → 200 image/svg+xml
  * Postgres healthy and reachable on 127.0.0.1:15432.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,27 @@
+# Copy to `.env` and adjust. `docker compose up` reads this file
+# automatically; the picloud binary on the host ignores it (use the
+# explicit env vars listed in CLAUDE.md).
+
+# ---------- Caddy ----------
+# Host port the dev stack listens on. Default 8000 because :80 needs
+# privileges and :8080 is occupied by an unrelated local service on
+# this dev machine.
+PICLOUD_HOST_PORT=8000
+
+# Production only — used by docker-compose.prod.yml. Caddy obtains a
+# Let's Encrypt certificate for PICLOUD_DOMAIN using PICLOUD_ADMIN_EMAIL.
+# PICLOUD_DOMAIN=picloud.example.com
+# PICLOUD_ADMIN_EMAIL=admin@example.com
+
+# ---------- Postgres ----------
+POSTGRES_DB=picloud
+POSTGRES_USER=picloud
+POSTGRES_PASSWORD=picloud
+
+# Host port the dev Postgres listens on (loopback only). Default 15432
+# because the conventional 5432 is frequently already bound locally.
+PICLOUD_POSTGRES_HOST_PORT=15432
+
+# ---------- Orchestrator ----------
+# tracing-subscriber filter; comma-separated module=level pairs.
+RUST_LOG=info,picloud=debug