Add docker-compose.yml for deploying upaas (closes #223)

The compose file builds the image from this repo, mounts the Docker
socket and HOST_DATA_DIR (passed to upaas as UPAAS_HOST_DATA_DIR),
reads settings from .env, and restarts unless stopped. The port is
published on 127.0.0.1 only, for a TLS-terminating proxy in front, and
PORT is pinned to 8080 so .env cannot move upaas off the port mapping
and the healthcheck, which uses the runtime image's busybox wget.

upaas now refuses to start when UPAAS_HOST_DATA_DIR is set to a
relative path; when unset it still falls back to the data directory.

The README's plain-HTTP Compose example becomes a short deploy section
that points at the file. .env is added to .dockerignore.

Model: opus-5-5

TODO.md

@@ -20,6 +20,12 @@ regress.
 
 # Completed Steps
 
+- 2026-09-28: Added `docker-compose.yml` for deploying upaas: settings from
+  `.env`, the port published on `127.0.0.1` only for a TLS proxy in front, and a
+  healthcheck against `/health`; the README's plain-HTTP Compose example is
+  replaced by a short deploy section. upaas now refuses to start when
+  `UPAAS_HOST_DATA_DIR` is set to a relative path (#223).
+
 - 2026-09-23: Apps are now built with BuildKit, so the stages of a multi-stage
   build stay in Docker's size-limited build cache instead of piling up as
   untagged images; build progress is still written to the deployment log as