Add Dockerfile, Compose stacks, and /healthz endpoint

Dockerfile is multi-stage:
- build: golang:1.25-bookworm, CGO_ENABLED=0 (modernc.org/sqlite
  is pure-Go) + -trimpath + -ldflags "-s -w" so the resulting
  binary is small and reproducible-ish.
- runtime: gcr.io/distroless/static:nonroot, ~2 MB. Runs as uid
  65532. /data and /var/lib/librenotes are declared volumes so
  per-tenant notes and the SQLite database survive container
  restarts.

healthcheck subcommand: distroless static has no shell or
wget/curl, so /healthz is reachable but no client to call it. A
new "librenotes healthcheck" subcommand uses net/http to GET
$LIBRENOTES_HEALTHCHECK_URL (default 127.0.0.1:8080/healthz) and
exits non-zero on failure. Both compose files invoke it from the
HEALTHCHECK directive.

httpapi adds a tiny GET /healthz that returns {"status":"ok"}
(no DB ping yet — added when readiness probes need it).

docker-compose.yml: dev stack on :8080 with named volumes and a
LogMailer; everything via env vars, JWT secret defaulted to a
dev value.
docker-compose.prod.yml: layered overrides — pulls a registry
image, expects LIBRENOTES_* env, sets memory limits and JSON-
file log rotation.

Closes #25.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,34 @@
+# docker-compose.yml — local development.
+#
+# Brings up librenotes on http://localhost:8080 with the magic-link
+# mailer logging links to stdout (no SMTP needed). Data lives in
+# named volumes so `docker compose down` does NOT wipe state.
+# Use `docker compose down -v` for a clean slate.
+services:
+  librenotes:
+    build:
+      context: .
+      args:
+        VERSION: dev
+    image: librenotes:dev
+    ports:
+      - "8080:8080"
+    environment:
+      LIBRENOTES_BASE_URL: "http://localhost:8080"
+      # JWT secret must be at least 32 bytes. Override per-host for
+      # any non-throwaway environment.
+      LIBRENOTES_JWT_SECRET: "dev-secret-32-bytes-of-keymaterial!!"
+    volumes:
+      - notes:/data
+      - state:/var/lib/librenotes
+    healthcheck:
+      test: ["CMD", "/librenotes", "healthcheck"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+    restart: unless-stopped
+
+volumes:
+  notes:
+  state: