Add Docker image + Gitea CI for Virgo Dev deploy

Containerize Hold Slayer as a single image (one FastAPI process serving
REST/WS/MCP and its built SvelteKit dashboard) for deployment to Virgo Dev
on triton.

- Dockerfile: 3-stage (node builds the dashboard → python wheels → runtime).
  Runs from source via `pip install -e .` so db/database.py resolves
  alembic.ini (via __file__.parent.parent) and migrations run on boot. The
  loose top-level modules (main.py, config.py) also require the source layout.
  pjsua2 is left unbuilt (documented stub media) — fine for a mock-SIP deploy.
- .dockerignore: keep .env and gitignored dashboard build artifacts out of
  the context; the node stage builds a fresh dashboard.
- CI (.gitea/workflows): single-image Trivy scan + build + push to
  git.helu.ca/r/hold-slayer (sha / latest-on-main / semver tags), mirroring
  the Demeter workflow. Requires a PACKAGE_TOKEN Actions secret.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,34 @@
+# Secrets — never bake into the image (injected at runtime via compose env).
+.env
+
+# The dashboard is rebuilt in the node stage and COPY'd in fresh; keep the
+# gitignored working-tree copies out of the build context.
+dashboard/build/
+dashboard/node_modules/
+dashboard/.svelte-kit/
+
+# Python build/cache cruft.
+__pycache__/
+**/__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+.pytest_cache/
+.ruff_cache/
+
+# Local runtime artifacts.
+recordings/
+*.db
+*.sqlite3
+
+# VCS / editor / OS.
+.git/
+.gitea/
+.vscode/
+.idea/
+.DS_Store
+
+# Not needed at runtime.
+tests/
+docs/