feat: containerize doctate-server for minerva deployment

Multi-stage Dockerfile, host-network compose, idempotent deploy script.
Configs and persistent data bind-mounted from /opt/stacks/doctate-server.
deploy-server.sh handles bootstrap + re-deploy in one command with
auto-prune (keep 5 last SHA-tagged images).

See docs/deployment.md for bootstrap, rollback, and TLS-proxy notes.

.dockerignore

@@ -0,0 +1,18 @@
+# Whitelist build-context: only `server/` and `common/` go into the image.
+# Cargo's path dep `server/Cargo.toml` -> `path = "../common"` requires
+# both directories side by side, so we must include `common/` explicitly.
+*
+!server/
+!common/
+
+# Re-exclude artifacts inside the whitelisted dirs.
+server/target/
+common/target/
+**/*.log
+**/*.bk
+
+# Secrets and operator-owned configs MUST NEVER end up in the image —
+# they are bind-mounted at runtime from /opt/stacks/doctate-server/config/.
+server/.env
+server/users.toml
+server/settings.toml