Add Dockerfile, compose, README and server entrypoint

Dockerfile

@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1
+
+# --- 1. Frontend : React + @excalidraw/excalidraw, build Vite -> /src/web/dist
+FROM node:22-alpine AS frontend
+WORKDIR /src/frontend
+COPY frontend/package.json frontend/package-lock.json ./
+RUN --mount=type=cache,target=/root/.npm npm ci --no-audit --no-fund
+COPY frontend/ ./
+RUN npm run build
+
+# --- 2. Backend : binaire Go statique embarquant le frontend
+FROM golang:1.24-alpine AS backend
+WORKDIR /src
+COPY go.mod ./
+COPY cmd ./cmd
+COPY internal ./internal
+COPY web/embed.go ./web/
+COPY --from=frontend /src/web/dist ./web/dist
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 go test ./internal/... && \
+    CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/server ./cmd/server && \
+    mkdir -p /out/data
+
+# --- 3. Image finale : distroless, non-root (uid 65532)
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=backend /out/server /server
+COPY --from=backend --chown=65532:65532 /out/data /data
+ENV LISTEN_ADDR=:8080 \
+    DATA_DIR=/data \
+    MAX_BODY_MB=50
+VOLUME ["/data"]
+EXPOSE 8080
+USER nonroot:nonroot
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 CMD ["/server", "healthcheck"]
+ENTRYPOINT ["/server"]