Add Docker setup: one script to set up/start/stop the full stack

A new developer needs only Docker Desktop — no local Go, Node, or PostgreSQL.

- docker-compose.yml: PostgreSQL + Go API + Angular (nginx) with healthcheck,
  migrations auto-applied via docker-entrypoint-initdb.d, data in a volume
- backend/Dockerfile: static Go binary on distroless (nonroot)
- frontend/Dockerfile: Angular prod build served by nginx, which proxies /api
  to the api service (same origin, no CORS)
- docker.ps1: setup / start / stop / restart / reset / rebuild / status / logs;
  reads DB creds from backend/.env (single source, nothing duplicated)
- .dockerignore keeps .env and local artifacts out of image build contexts
- README: "Run with Docker" quick start

Not yet run end to end here (Docker is not installed on this machine); the
compose and script are validated for syntax and structure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -20,6 +20,33 @@ Authentication is HTTP **Basic auth**, as requested, scoped per tenant.
 
 ---
 
+## Run with Docker (quickest — no local toolchain)
+
+A new developer needs **only Docker Desktop** — no local Go, Node, or
+PostgreSQL. One script sets up, starts and stops the whole stack:
+
+```powershell
+# one-time: set the DB password the containers will use
+cp backend\.env.example backend\.env   # then edit DB_PASSWORD
+
+.\docker.ps1 setup       # build images, start everything, seed the database
+.\docker.ps1 stop        # stop (keeps data)
+.\docker.ps1 start       # start again
+.\docker.ps1 reset       # wipe data and re-seed with fresh flight dates
+.\docker.ps1 logs -Follow
+```
+
+Then open **http://localhost:4200** (nginx serves the SPA and proxies `/api` to
+the Go API on `:8080`). Sign in with any demo account, password `demo1234`.
+
+The database is created and seeded on first `setup` via the migrations mounted
+into PostgreSQL. Don't run the native `app.ps1` at the same time — it uses the
+same ports.
+
+For local development without containers, use the native setup below.
+
+---
+
 ## Prerequisites
 
 | Tool       | Version used here |