Add Docker setup: one script to set up/start/stop the full stack

A new developer needs only Docker Desktop — no local Go, Node, or PostgreSQL.

- docker-compose.yml: PostgreSQL + Go API + Angular (nginx) with healthcheck,
  migrations auto-applied via docker-entrypoint-initdb.d, data in a volume
- backend/Dockerfile: static Go binary on distroless (nonroot)
- frontend/Dockerfile: Angular prod build served by nginx, which proxies /api
  to the api service (same origin, no CORS)
- docker.ps1: setup / start / stop / restart / reset / rebuild / status / logs;
  reads DB creds from backend/.env (single source, nothing duplicated)
- .dockerignore keeps .env and local artifacts out of image build contexts
- README: "Run with Docker" quick start

Not yet run end to end here (Docker is not installed on this machine); the
compose and script are validated for syntax and structure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/.dockerignore

@@ -0,0 +1,11 @@
+# Keep secrets and local artifacts out of the build context and image layers.
+.env
+*.env
+!.env.example
+bin/
+coverage
+coverage.out
+*.exe
+*.test
+Dockerfile
+.dockerignore

backend/Dockerfile

@@ -0,0 +1,20 @@
+# --- build -----------------------------------------------------------------
+# Static Go binary so the runtime image can be distroless (no shell, tiny,
+# minimal attack surface). pgx is pure Go, so CGO can be disabled.
+FROM golang:1.26 AS build
+WORKDIR /src
+
+# Cache modules separately from source for faster rebuilds.
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/api ./cmd/api
+
+# --- runtime ---------------------------------------------------------------
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /out/api /api
+EXPOSE 8080
+# Config comes from the environment (DB_HOST, DB_PASSWORD, PORT, …), set by
+# docker-compose. No .env file is baked into the image.
+ENTRYPOINT ["/api"]