feat: containerise the site with nginx-unprivileged

Serve the static site from a non-root nginx image listening on 8080,
with cache headers, gzip and a /healthz endpoint. Designed to run behind
an external reverse proxy that terminates TLS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,12 @@
+# Keep the build context minimal; only the site assets and nginx config
+# referenced by the Dockerfile are needed.
+.git
+.gitea
+.github
+.idea
+.vscode
+*.md
+renovate.json
+.renovaterc*
+Dockerfile
+.dockerignore