build: Docker setup (compose: postgres + all-in-one api image)

- Dockerfile: 3-stage — Flutter web build, NestJS build, slim node runtime.
  Runtime copies dist + node_modules + prisma + the web bundle
  (WEB_CLIENT_DIR=/app/web), runs `prisma migrate deploy` then `node
  dist/main.js`. One container serves client + API on :3000.
- docker-compose.yml: postgres:16-alpine with a healthcheck + the api
  service; config from backend/.env (Compose v2 strips quotes),
  DATABASE_URL + GOOGLE_APPLICATION_CREDENTIALS overridden for the
  container, serviceAccount.json bind-mounted read-only.
- .dockerignore keeps node_modules/build/secrets out of the context.

Not run here (no Docker on this box); the stack also runs natively against
the local Postgres.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,40 @@
+services:
+  db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: kcapp
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d kcapp"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  api:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    depends_on:
+      db:
+        condition: service_healthy
+    # All non-DB config comes from backend/.env (needs Docker Compose v2,
+    # which strips surrounding quotes). DATABASE_URL and the FCM credential
+    # path are overridden below for the container.
+    env_file:
+      - backend/.env
+    environment:
+      DATABASE_URL: postgresql://postgres:postgres@db:5432/kcapp?schema=public
+      PORT: "3000"
+      GOOGLE_APPLICATION_CREDENTIALS: /app/serviceAccount.json
+      APP_BASE_URL: http://localhost:3000
+    ports:
+      - "3000:3000"
+    volumes:
+      # Firebase service account — kept out of the image, mounted read-only.
+      - ./backend/serviceAccount.json:/app/serviceAccount.json:ro
+
+volumes:
+  pgdata: