Add multi-stage Dockerfile for container deployment

Three-stage build:
- assets: Node 22 + Vite + Tailwind CSS 4 → static/dist/main.css
- python-deps: uv sync --frozen --no-dev against pyproject + uv.lock,
  with the issue-core path dependency satisfied via a BuildKit
  named context (--build-context issue-core=...)
- runtime: python:3.12-slim-bookworm + libpq5 + curl, non-root 'app'
  user, collectstatic at build time, gunicorn on :8000,
  /health/ HEALTHCHECK every 30s

Adds gunicorn>=22 to project dependencies (was missing).

Build:
  docker build --build-context issue-core=/home/worsch/issue-core \
    -t gitea.coulomb.social/coulomb/vergabe-teilnahme:<tag> .

Smoke-verified: container reports (healthy) and /health/ returns
{"status": "ok"} without a database connection.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,85 @@
+# syntax=docker/dockerfile:1.7
+#
+# Build:
+#   docker build \
+#     --build-context issue-core=/home/worsch/issue-core \
+#     -t gitea.coulomb.social/coulomb/vergabe-teilnahme:<tag> .
+#
+# The `issue-core` named context is required because pyproject.toml has
+# a path dependency on a sibling repo; uv.lock pins it as "../issue-core".
+
+
+# ─── Stage 1 ─── Vite + Tailwind asset build ────────────────────────────────
+FROM node:22-alpine AS assets
+WORKDIR /build
+COPY package.json package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY vite.config.js ./
+COPY static/src ./static/src
+RUN npm run build
+# Output: /build/static/dist/main.css
+
+
+# ─── Stage 2 ─── Python deps via uv ─────────────────────────────────────────
+FROM python:3.12-slim-bookworm AS python-deps
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential libpq-dev curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/astral-sh/uv:0.5.11 /uv /usr/local/bin/uv
+
+COPY --from=issue-core . /issue-core/
+WORKDIR /app
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project
+
+
+# ─── Stage 3 ─── Runtime image ──────────────────────────────────────────────
+FROM python:3.12-slim-bookworm AS runtime
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    DJANGO_SETTINGS_MODULE=vergabe_teilnahme.settings.prod \
+    PATH=/app/.venv/bin:$PATH \
+    PORT=8000
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libpq5 curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd -r app && useradd -r -g app -d /app -s /sbin/nologin app
+
+WORKDIR /app
+
+COPY --from=python-deps /issue-core /issue-core
+COPY --from=python-deps /app/.venv ./.venv
+
+COPY --chown=app:app manage.py pyproject.toml ./
+COPY --chown=app:app vergabe_teilnahme ./vergabe_teilnahme
+COPY --chown=app:app static/src ./static/src
+COPY --chown=app:app static/vendor ./static/vendor
+COPY --chown=app:app templates ./templates
+COPY --from=assets --chown=app:app /build/static/dist ./static/dist
+
+RUN mkdir -p ./media ./staticfiles ./.issue-facade && chown -R app:app /app
+
+# collectstatic needs SECRET_KEY + ALLOWED_HOSTS but no DB; provide placeholders.
+RUN SECRET_KEY=build-only ALLOWED_HOSTS=localhost \
+    python manage.py collectstatic --noinput
+
+USER app
+EXPOSE 8000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+    CMD curl -fsS http://127.0.0.1:8000/health/ || exit 1
+
+CMD ["gunicorn", "vergabe_teilnahme.wsgi:application", \
+     "--bind", "0.0.0.0:8000", \
+     "--workers", "3", \
+     "--access-logfile", "-", \
+     "--error-logfile", "-"]