build: Docker setup (compose: postgres + all-in-one api image)

- Dockerfile: 3-stage — Flutter web build, NestJS build, slim node runtime.
  Runtime copies dist + node_modules + prisma + the web bundle
  (WEB_CLIENT_DIR=/app/web), runs `prisma migrate deploy` then `node
  dist/main.js`. One container serves client + API on :3000.
- docker-compose.yml: postgres:16-alpine with a healthcheck + the api
  service; config from backend/.env (Compose v2 strips quotes),
  DATABASE_URL + GOOGLE_APPLICATION_CREDENTIALS overridden for the
  container, serviceAccount.json bind-mounted read-only.
- .dockerignore keeps node_modules/build/secrets out of the context.

Not run here (no Docker on this box); the stack also runs natively against
the local Postgres.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -5,6 +5,21 @@ events (KCs), replacing the WordPress plugin "Workshop-Wahlen". See
 [plan-kcAppMultiTenantPlatform.prompt.md](plan-kcAppMultiTenantPlatform.prompt.md)
 for the full architecture and phased roadmap.
 
+## Run with Docker
+
+```bash
+cp backend/.env.example backend/.env      # fill in the secrets
+# put the Firebase service account at backend/serviceAccount.json (optional; push)
+docker compose up --build
+```
+
+`docker-compose.yml` starts PostgreSQL 16 and one `api` container (multi-stage
+`Dockerfile`: Flutter web build → NestJS build → slim runtime). The container
+runs `prisma migrate deploy` on start and serves the whole app — Flutter web
+client + REST API — on <http://localhost:3000>. Requires Docker Compose v2.
+Secrets are read from `backend/.env` and the service-account JSON is bind-
+mounted read-only; neither is baked into the image.
+
 ## Structure
 
 - `backend/` — NestJS API (Prisma/PostgreSQL, Authentik OIDC as resource