Add docker-compose.yml for deploying upaas (closes #223)

The compose file builds the image from this repo, mounts the Docker
socket and HOST_DATA_DIR (passed to upaas as UPAAS_HOST_DATA_DIR),
reads settings from .env, and restarts unless stopped. The port is
published on 127.0.0.1 only, for a TLS-terminating proxy in front, and
UPAAS_PLAINTEXT_HTTP is left unset. A healthcheck against /health uses
the runtime image's busybox wget.

The README's plain-HTTP Compose example becomes a short deploy section
that points at the file. .env is added to .dockerignore so settings are
not copied into the build.

Model: opus-5-5

TODO.md

@@ -20,6 +20,11 @@ regress.
 
 # Completed Steps
 
+- 2026-09-28: Added `docker-compose.yml` for deploying upaas: settings from
+  `.env`, the port published on `127.0.0.1` only for a TLS proxy in front, and a
+  healthcheck against `/health`; the README's plain-HTTP Compose example is
+  replaced by a short deploy section (#223).
+
 - 2026-09-23: Apps are now built with BuildKit, so the stages of a multi-stage
   build stay in Docker's size-limited build cache instead of piling up as
   untagged images; build progress is still written to the deployment log as