feat: containerize doctate-server for minerva deployment

Multi-stage Dockerfile, host-network compose, idempotent deploy script.
Configs and persistent data bind-mounted from /opt/stacks/doctate-server.
deploy-server.sh handles bootstrap + re-deploy in one command with
auto-prune (keep 5 last SHA-tagged images).

See docs/deployment.md for bootstrap, rollback, and TLS-proxy notes.

deploy/doctate-server.compose.yml

@@ -0,0 +1,47 @@
+# Compose file for the doctate-server container on minerva.
+# Operator config + persistent data live under /opt/stacks/doctate-server/
+# (Dockge convention). The image itself is self-contained except at the
+# bind-mount points listed under `volumes:`.
+#
+# `network_mode: host` means the container binds directly on minerva's
+# network namespace. Settings.toml URLs like http://minerva.lan:9001
+# resolve identically inside and outside the container — no Docker DNS
+# magic, no port mapping.
+
+services:
+  doctate-server:
+    image: doctate-server:latest
+    container_name: doctate-server
+    network_mode: host
+    restart: unless-stopped
+    working_dir: /app
+    environment:
+      # Required — server panics on boot if missing (see config.rs).
+      USERS_FILE: /app/users.toml
+      SERVER_PORT: "3000"
+      DATA_PATH: /data
+      # Optional — explicit values to avoid silent defaults.
+      SETTINGS_FILE: /app/settings.toml
+      LOG_PATH: /var/log/recorder
+      LOG_LEVEL: info
+      LOG_MAX_DAYS: "90"
+      VOCAB_DIR: /app/vocab
+      HUNSPELL_DICT: /usr/share/hunspell/de_DE.dic
+      SESSION_TIMEOUT_HOURS: "8"
+      # false because no TLS reverse-proxy is in front of this service yet.
+      # Browsers refuse Secure cookies on plain HTTP — set to true once a
+      # TLS proxy (e.g. nginx on the Unraid box) terminates in front of
+      # this container. Override via /opt/stacks/doctate-server/config/.env.
+      COOKIE_SECURE: "false"
+      ASR_BACKEND: whisper
+    volumes:
+      # Operator-owned configs — read-only, atomically edited on host.
+      - /opt/stacks/doctate-server/config/.env:/app/.env:ro
+      - /opt/stacks/doctate-server/config/settings.toml:/app/settings.toml:ro
+      - /opt/stacks/doctate-server/config/users.toml:/app/users.toml:ro
+      # Persistent data — container writes here.
+      - /opt/stacks/doctate-server/data:/data
+      - /opt/stacks/doctate-server/logs:/var/log/recorder
+      # Optional vocab override — uncomment if a curated list is maintained
+      # on minerva that should win over the bundled /app/vocab/*.txt.
+      # - /opt/stacks/doctate-server/config/vocab:/app/vocab:ro