Add docker-compose.yml for deploying upaas (closes #223)

The compose file builds the image from this repo, mounts the Docker
socket and HOST_DATA_DIR (passed to upaas as UPAAS_HOST_DATA_DIR),
reads settings from .env, and restarts unless stopped. The port is
published on 127.0.0.1 only, for a TLS-terminating proxy in front.
PORT and UPAAS_DATA_DIR are pinned so .env cannot move upaas off the
port mapping, the healthcheck (busybox wget) or the data mount.

upaas now refuses to start when UPAAS_HOST_DATA_DIR is set to a
relative path; when unset it still falls back to the data directory.

The README's plain-HTTP Compose example becomes a short deploy section
that points at the file. .env is added to .dockerignore.

Model: opus-5-5

README.md

@@ -219,39 +219,30 @@ This recipe serves plain HTTP, so `UPAAS_PLAINTEXT_HTTP=true` is required for
 setup and every other form to pass the CSRF origin check. Behind a
 TLS-terminating reverse proxy, drop that line.
 
-### Docker Compose
+### Deploying with Docker Compose
 
-```yaml
-services:
-    upaas:
-        build: .
-        restart: unless-stopped
-        ports:
-            - "8080:8080"
-        volumes:
-            - /var/run/docker.sock:/var/run/docker.sock
-            - ${HOST_DATA_DIR}:/var/lib/upaas
-        environment:
-            - UPAAS_HOST_DATA_DIR=${HOST_DATA_DIR}
-            # Set when serving plain HTTP (no TLS-terminating proxy); drop behind one
-            - UPAAS_PLAINTEXT_HTTP=true
-            # Optional: uncomment to enable debug logging
-            # - DEBUG=true
-            # Optional: Sentry error reporting
-            # - SENTRY_DSN=https://...
-            # Optional: Prometheus metrics auth
-            # - METRICS_USERNAME=prometheus
-            # - METRICS_PASSWORD=secret
+[`docker-compose.yml`](docker-compose.yml) builds the image from this repo and
+runs it with the Docker socket and the data directory mounted. It reads its
+settings from a `.env` file next to it, which needs at least:
+
+```bash
+HOST_DATA_DIR=/srv/upaas/data
 ```
 
-**Important**: You **must** set `HOST_DATA_DIR` to an **absolute path** on the
-host before running `docker compose up`. This value is bind-mounted into the
-container and passed as `UPAAS_HOST_DATA_DIR` so that Docker bind mounts during
-builds resolve correctly. Relative paths (e.g. `./data`) will break container
-builds because the Docker daemon resolves paths relative to the host, not the
-container.
+Other settings from [Configuration](#configuration) go in the same file, except
+`PORT` and `UPAAS_DATA_DIR`: the compose file sets them to 8080 and
+`/var/lib/upaas`, overriding `.env`, to match its port mapping, healthcheck and
+data directory mount. Then run `docker compose up -d` from the repo root;
+`docker compose ps` shows the container as healthy once `/health` answers.
 
-Example: `HOST_DATA_DIR=/srv/upaas/data docker compose up -d`
+**Important**: `HOST_DATA_DIR` **must** be an **absolute path** on the host. It
+is bind-mounted into the container and passed as `UPAAS_HOST_DATA_DIR` so that
+Docker bind mounts during builds resolve correctly, because the Docker daemon
+resolves paths on the host, not in the container. upaas refuses to start when
+`UPAAS_HOST_DATA_DIR` is a relative path such as `./data`.
+
+The port is published on `127.0.0.1:8080` only, for a TLS-terminating reverse
+proxy in front of it. Leave `UPAAS_PLAINTEXT_HTTP` unset behind that proxy.
 
 Apps are built with BuildKit, so the stages of a multi-stage build are kept in
 Docker's build cache rather than as untagged images. Docker Engine 28.2 and