Add docker-compose.yml for deploying upaas (closes #223)

The compose file builds the image from this repo, mounts the Docker
socket and HOST_DATA_DIR (passed to upaas as UPAAS_HOST_DATA_DIR),
reads settings from .env, and restarts unless stopped. The port is
published on 127.0.0.1 only, for a TLS-terminating proxy in front, and
PORT is pinned to 8080 so .env cannot move upaas off the port mapping
and the healthcheck, which uses the runtime image's busybox wget.

upaas now refuses to start when UPAAS_HOST_DATA_DIR is set to a
relative path; when unset it still falls back to the data directory.

The README's plain-HTTP Compose example becomes a short deploy section
that points at the file. .env is added to .dockerignore.

Model: opus-5-5

README.md

@@ -219,39 +219,29 @@ This recipe serves plain HTTP, so `UPAAS_PLAINTEXT_HTTP=true` is required for
 setup and every other form to pass the CSRF origin check. Behind a
 TLS-terminating reverse proxy, drop that line.
 
-### Docker Compose
+### Deploying with Docker Compose
 
-```yaml
-services:
-    upaas:
-        build: .
-        restart: unless-stopped
-        ports:
-            - "8080:8080"
-        volumes:
-            - /var/run/docker.sock:/var/run/docker.sock
-            - ${HOST_DATA_DIR}:/var/lib/upaas
-        environment:
-            - UPAAS_HOST_DATA_DIR=${HOST_DATA_DIR}
-            # Set when serving plain HTTP (no TLS-terminating proxy); drop behind one
-            - UPAAS_PLAINTEXT_HTTP=true
-            # Optional: uncomment to enable debug logging
-            # - DEBUG=true
-            # Optional: Sentry error reporting
-            # - SENTRY_DSN=https://...
-            # Optional: Prometheus metrics auth
-            # - METRICS_USERNAME=prometheus
-            # - METRICS_PASSWORD=secret
+[`docker-compose.yml`](docker-compose.yml) builds the image from this repo and
+runs it with the Docker socket and the data directory mounted. It reads its
+settings from a `.env` file next to it, which needs at least:
+
+```bash
+HOST_DATA_DIR=/srv/upaas/data
 ```
 
-**Important**: You **must** set `HOST_DATA_DIR` to an **absolute path** on the
-host before running `docker compose up`. This value is bind-mounted into the
-container and passed as `UPAAS_HOST_DATA_DIR` so that Docker bind mounts during
-builds resolve correctly. Relative paths (e.g. `./data`) will break container
-builds because the Docker daemon resolves paths relative to the host, not the
-container.
+Other settings from [Configuration](#configuration) go in the same file, except
+`PORT`: the compose file sets it to 8080, overriding `.env`, to match its port
+mapping and healthcheck. Then run `docker compose up -d` from the repo root;
+`docker compose ps` shows the container as healthy once `/health` answers.
 
-Example: `HOST_DATA_DIR=/srv/upaas/data docker compose up -d`
+**Important**: `HOST_DATA_DIR` **must** be an **absolute path** on the host. It
+is bind-mounted into the container and passed as `UPAAS_HOST_DATA_DIR` so that
+Docker bind mounts during builds resolve correctly, because the Docker daemon
+resolves paths on the host, not in the container. upaas refuses to start when
+`UPAAS_HOST_DATA_DIR` is a relative path such as `./data`.
+
+The port is published on `127.0.0.1:8080` only, for a TLS-terminating reverse
+proxy in front of it. Leave `UPAAS_PLAINTEXT_HTTP` unset behind that proxy.
 
 Apps are built with BuildKit, so the stages of a multi-stage build are kept in
 Docker's build cache rather than as untagged images. Docker Engine 28.2 and