Add Docker setup: one script to set up/start/stop the full stack

A new developer needs only Docker Desktop — no local Go, Node, or PostgreSQL.

- docker-compose.yml: PostgreSQL + Go API + Angular (nginx) with healthcheck,
  migrations auto-applied via docker-entrypoint-initdb.d, data in a volume
- backend/Dockerfile: static Go binary on distroless (nonroot)
- frontend/Dockerfile: Angular prod build served by nginx, which proxies /api
  to the api service (same origin, no CORS)
- docker.ps1: setup / start / stop / restart / reset / rebuild / status / logs;
  reads DB creds from backend/.env (single source, nothing duplicated)
- .dockerignore keeps .env and local artifacts out of image build contexts
- README: "Run with Docker" quick start

Not yet run end to end here (Docker is not installed on this machine); the
compose and script are validated for syntax and structure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/nginx.conf

@@ -0,0 +1,26 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # API calls go to the Go service over the compose network. Because the
+    # browser reaches both the app and /api on the same origin (localhost:4200),
+    # there is no CORS to configure.
+    location /api/ {
+        proxy_pass         http://api:8080;
+        proxy_http_version 1.1;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+        # Pass through the auth and tenant headers the SPA sends.
+        proxy_pass_request_headers on;
+    }
+
+    # Angular is a single-page app: unknown paths fall back to index.html so
+    # client-side routing works on reload / deep link.
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}