Add Docker build and compose setup

Three-stage build: bun compiles the frontend, cargo embeds it into the
release binary, and the runtime stage carries only that binary on
debian:trixie-slim as an unprivileged user.

compose.yml pins DIARY_BIND and DIARY_DATA_DIR over whatever .env says,
keeps state in a named volume, publishes on localhost only and probes the
port with bash so the image needs no curl. compose.override.yml.example
shows the traefik overlay for the personal host.

.dockerignore

@@ -0,0 +1,11 @@
+.git
+.env
+target
+data
+web/dist
+web/node_modules
+README.md
+Makefile
+Dockerfile
+.dockerignore
+compose*.yml