Add docker-compose.yml for deploying upaas (closes #223)

The compose file builds the image from this repo, mounts the Docker
socket and HOST_DATA_DIR (passed to upaas as UPAAS_HOST_DATA_DIR),
reads settings from .env, and restarts unless stopped. The port is
published on 127.0.0.1 only, for a TLS-terminating proxy in front, and
PORT is pinned to 8080 so .env cannot move upaas off the port mapping
and the healthcheck, which uses the runtime image's busybox wget.

upaas now refuses to start when UPAAS_HOST_DATA_DIR is set to a
relative path; when unset it still falls back to the data directory.

The README's plain-HTTP Compose example becomes a short deploy section
that points at the file. .env is added to .dockerignore.

Model: opus-5-5

README.md

@@ -230,9 +230,8 @@ HOST_DATA_DIR=/srv/upaas/data
 ```
 
 Other settings from [Configuration](#configuration) go in the same file, except
-`PORT` and `UPAAS_DATA_DIR`: the compose file sets them to 8080 and
+`PORT`: the compose file sets it to 8080, overriding `.env`, to match its port
-`/var/lib/upaas`, overriding `.env`, to match its port mapping, healthcheck and
+mapping and healthcheck. Then run `docker compose up -d` from the repo root;
-data directory mount. Then run `docker compose up -d` from the repo root;
 `docker compose ps` shows the container as healthy once `/health` answers.
 
 **Important**: `HOST_DATA_DIR` **must** be an **absolute path** on the host. It

docker-compose.yml

@@ -10,9 +10,6 @@ services:
       # Overrides any PORT in .env, so upaas listens where the port mapping
       # and healthcheck below expect it.
       PORT: "8080"
-      # Overrides any UPAAS_DATA_DIR in .env, so the database stays on the
-      # HOST_DATA_DIR mount below instead of inside the container.
-      UPAAS_DATA_DIR: /var/lib/upaas
       # The Docker daemon resolves app bind mounts on the host, so upaas must
       # know the host path of its data directory.
       UPAAS_HOST_DATA_DIR: ${HOST_DATA_DIR:?set HOST_DATA_DIR in .env to an absolute host path}