build: docker image and compose

Dockerfile on oven/bun:1.3 with ffmpeg, git, unzip and python3-pymupdf, a
production install, non-root user, /data volume and a health check;
docker-compose.yml (project stc) with an optional postgres:17 profile and
read-only course and import mounts; docs/operations.md with configuration,
mounts, security headers and the measured idle memory (101.4 MiB for app plus
Postgres after 5 minutes idle).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -11,4 +11,9 @@ bun run typecheck    # tsc --noEmit
 bun run dev          # start the server with hot reload
 ```
 
+## Running it
+
+`STC_SECRET=... docker compose up -d` (add `--profile postgres` and `STC_DATABASE_URL` for Postgres). Mounts,
+configuration and the measured memory budget are in [docs/operations.md](docs/operations.md).
+
 License: AGPL-3.0-only.