build: Dockerfile and compose for VM103 behind traefik

One image for both processes (node:24-slim pinned by digest, Node 24.21 / SQLite 3.53 as in development).
compose: server on the proxy network with traefik labels in the house convention (web-secured, certresolver http,
ipwhitelist LAN only), driver with no network; both non-root, read-only rootfs, no capabilities, no host port,
no Docker socket. Data in /srv/appdata/homelab-upgrade/data.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,15 @@
+.git
+node_modules
+dist
+coverage
+data
+docs
+tools
+deploy
+.env
+.env.*
+*.log
+*.sqlite*
+src/testing
+**/*.test.ts
+**/*.test.tsx