add Dockerfile + deployment docs; make config dbPath optional

node:24-bookworm-slim image with git for the read-only vault endpoints,
non-root user with system-wide git safe.directory (mounted vaults are
usually owned by a host uid), /config + /data + /vaults mount
conventions baked in via BRAINDUMP_CONFIG/BRAINDUMP_DB, and an
/api/health healthcheck. README gains a Deployment section (mounts,
claude-sdk skill/auth requirements in-container, compose example,
reverse-proxy SSE buffering notes).

dbPath in the config file now defaults to ./braindump.sqlite instead of
being required — it was validated before the BRAINDUMP_DB env override
was applied, so the image's baked-in db path couldn't rescue a config
that omitted it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,34 @@
+FROM node:24-bookworm-slim
+
+# git is needed for the read-only /git/status and /git/diff endpoints
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends git ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN npm ci
+
+COPY tsconfig.json config.example.jsonc ./
+COPY src ./src
+COPY scripts ./scripts
+
+# Non-root user. Mounted vaults are usually owned by a host uid that doesn't
+# match the container user, which git refuses to touch by default — allow it
+# system-wide (read-only endpoints only; braindump never commits).
+RUN useradd -m braindump \
+ && git config --system --add safe.directory '*' \
+ && mkdir -p /data /config /vaults \
+ && chown braindump /data
+
+USER braindump
+ENV BRAINDUMP_CONFIG=/config/config.jsonc \
+    BRAINDUMP_DB=/data/braindump.sqlite \
+    NODE_ENV=production
+
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
+  CMD node -e "fetch('http://localhost:'+(process.env.PORT||3000)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["npx", "tsx", "src/bin/braindump-web.ts"]