feat: add Docker image, static server and GitLab CI

The server is a placeholder for the one in docs/ARCHITECTURE.md — it serves
public/ and a health endpoint, nothing more. Reads are confined to public/ by
resolving the path and checking it stays inside the root; string-matching
".." is not enough, since encodings and URL normalisation both change what
the string looks like and only the resolved path says which file would open.

The image runs typecheck and tests during build, ships no source or
toolchain, and runs unprivileged.

CI's feed job fails if the event count collapses. A source that quietly stops
yielding events is what a parser-only pipeline is most prone to, and nothing
else would surface it. Everything is offline, so a red pipeline always means
the code changed rather than a wiki being down.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

README.md

@@ -28,12 +28,21 @@ against real parsed data, and it produces exactly the shape the server will serv
 
 ```bash
 bun install
-bun run build      # parse fixtures → feed, then compile CSS and JS
-bunx serve public  # or any static file server
+bun run dev        # build, then serve on :3000
 ```
 
 Then open <http://localhost:3000>.
 
+Or with Docker:
+
+```bash
+docker build -t event-clock .
+docker run --rm -p 3000:3000 event-clock
+```
+
+The image build runs typecheck and tests, and parses only checked-in fixtures — no network, so it is
+reproducible and a wiki being down never breaks it.
+
 ## Commands
 
 ```bash
@@ -137,6 +146,13 @@ so iteration never re-fetches. Every event links back to its source.
 | `docs/DATA-MODEL.md` | Event schema, SQLite tables, client storage |
 | `docs/INGESTION.md` | Parser/adapter/merge layers, pipeline stages, review gate |
 
+## CI
+
+`.gitlab-ci.yml` runs typecheck, tests and a feed sanity check on every push, then builds and
+publishes a container image from the default branch. The feed job fails if the event count collapses
+— a source that quietly stops yielding events is the failure mode a parser-only pipeline is most
+prone to, and nothing else surfaces it.
+
 ## Licence
 
 Not yet chosen. Event data belongs to the sources it came from and is linked back on every event.