Add Docker build and compose setup

Three-stage build: bun compiles the frontend, cargo embeds it into the
release binary, and the runtime stage carries only that binary on
debian:trixie-slim as an unprivileged user.

compose.yml pins DIARY_BIND and DIARY_DATA_DIR over whatever .env says,
keeps state in a named volume, publishes on localhost only and probes the
port with bash so the image needs no curl. compose.override.yml.example
shows the traefik overlay for the personal host.

compose.override.yml.example

@@ -0,0 +1,18 @@
+# Copy to compose.override.yml on the host that runs traefik.
+services:
+  diary:
+    ports: !override []
+    networks:
+      - narl
+      - internal_net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=narl"
+      - "traefik.http.routers.diary.rule=Host(`diary.narl.io`)"
+      - "traefik.http.routers.diary.entrypoints=websecure"
+      - "traefik.http.routers.diary.tls.certresolver=https_resolver"
+      - "traefik.http.services.diary.loadbalancer.server.port=4242"
+
+networks:
+  narl:
+    external: true