feat(compose): full-stack Caddy + docker-compose wiring

Brings up the whole platform behind a single Caddy entrypoint so the
routing topology can be exercised end-to-end before any feature code
lands. Same Caddyfile shape (admin / data plane / dashboard) maps to
single-process MVP today and will map to cluster mode later by
swapping the upstream lists, not by restructuring the proxy.

  * caddy/Caddyfile — dev: HTTP only, picloud and dashboard upstreams
    by service name. caddy/Caddyfile.prod — Let's Encrypt for
    PICLOUD_DOMAIN with PICLOUD_ADMIN_EMAIL.
  * docker/orchestrator.Dockerfile — multi-stage build of the
    `picloud` all-in-one against the pinned 1.92 toolchain; debian
    slim runtime, non-root user, /healthz HEALTHCHECK.
  * docker/dashboard.Dockerfile — node:24-alpine builder + caddy
    runtime that serves the static SPA with SPA fallback.
  * docker-compose.yml — postgres + picloud + dashboard + caddy,
    Caddy exposed on host :8000 (configurable), Postgres on :15432
    (loopback only). Health-gated startup ordering.
  * docker-compose.prod.yml — overlay: removes Postgres host
    mapping, expands Caddy to 80/443/443udp, swaps Caddyfile.prod,
    adds restart policy.
  * .env.example documents every knob the compose stack reads.

Verified via `docker compose up -d`:
  * `curl :8000/healthz` → 200 ok (orchestrator)
  * `curl :8000/api/admin/scripts` → 404 (manager, routed correctly)
  * `curl :8000/api/execute/<id>` → 404 (orchestrator, routed correctly)
  * `curl :8000/` → SPA index served (dashboard via Caddy)
  * `curl :8000/favicon.svg` → 200 image/svg+xml
  * Postgres healthy and reachable on 127.0.0.1:15432.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,72 @@
+# Default PiCloud stack. Runs the full system end-to-end behind a single
+# Caddy entrypoint, suitable for local development and for verifying that
+# the wiring still works after architectural changes.
+#
+# Caddy is exposed on host port ${PICLOUD_HOST_PORT:-8000} (defaults to
+# 8000 because host port 80 commonly needs sudo on Linux and port 8080 is
+# already in use on this dev machine).
+#
+# For real production deployment, layer the production overrides on top:
+#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+
+name: picloud
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-picloud}
+      POSTGRES_USER: ${POSTGRES_USER:-picloud}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-picloud}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    ports:
+      # Exposed in dev so you can poke at the DB with psql. Configurable
+      # because the conventional 5432 is often already in use locally;
+      # the prod overlay removes this mapping entirely.
+      - "127.0.0.1:${PICLOUD_POSTGRES_HOST_PORT:-15432}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-picloud} -d ${POSTGRES_DB:-picloud}"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+  picloud:
+    build:
+      context: .
+      dockerfile: docker/orchestrator.Dockerfile
+    environment:
+      PICLOUD_BIND: 0.0.0.0:8080
+      DATABASE_URL: postgres://${POSTGRES_USER:-picloud}:${POSTGRES_PASSWORD:-picloud}@postgres:5432/${POSTGRES_DB:-picloud}
+      RUST_LOG: ${RUST_LOG:-info}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    expose:
+      - "8080"
+
+  dashboard:
+    build:
+      context: ./dashboard
+      dockerfile: ../docker/dashboard.Dockerfile
+    expose:
+      - "80"
+
+  caddy:
+    image: caddy:2-alpine
+    ports:
+      - "${PICLOUD_HOST_PORT:-8000}:80"
+    volumes:
+      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      picloud:
+        condition: service_started
+      dashboard:
+        condition: service_started
+
+volumes:
+  postgres_data:
+  caddy_data:
+  caddy_config: