Add Docker Compose deployment

- Dockerfile: Node.js 20 Alpine, single-stage build
- docker-compose.yml: backend + nginx, named volume for SQLite
- server.js: updated for Docker (env vars for PORT/DATA_DIR)
- nginx.conf: updated for Docker networking (backend hostname)
- README.md: full deployment instructions

deploy/README.md

@@ -0,0 +1,74 @@
+# Project Tracker - Docker Compose Deployment
+
+## Quick Start
+
+```bash
+cd deploy
+docker compose up -d
+```
+
+App available at `http://<your-server-ip>`
+
+## First Run Notes
+
+- The SQLite database initializes automatically on first start
+- The database file is persisted in a Docker named volume (`project-tracker-data`)
+- To seed with sample projects, exec into the container:
+  ```bash
+  docker exec -it project-tracker-api node -e "
+    const db = require('better-sqlite3')('/app/data/projects.db');
+    const items = [
+      {name:'Bastion setup with Headscale/Tailscale',priority:'Medium',url:'',notes:'Use i3-4130T as hardened jump-box/gateway into homelab.',status:'Active',owner:'Ada',tags:'vpn,homelab,security'},
+      {name:'Outline',priority:'Med-High',url:'https://www.getoutline.com/',notes:'Self-hosted knowledge base/wiki (Notion alternative).',status:'Backlog',owner:'Ada',tags:'wiki,notes'},
+      {name:'Tinyauth',priority:'Med-High',url:'https://tinyauth.app/',notes:'Self-hosted zero-trust authentication platform.',status:'Backlog',owner:'Ada',tags:'auth,security'}
+    ];
+    const stmt = db.prepare('INSERT INTO projects (name,priority,url,notes,status,owner,tags) VALUES (?,?,?,?,?,?,?)');
+    items.forEach(i => stmt.run(i.name,i.priority,i.url,i.notes,i.status,i.owner,i.tags));
+    console.log('Seeded', items.length, 'projects');
+  "
+  ```
+
+## Commands
+
+```bash
+docker compose up -d          # Start
+docker compose logs -f        # View logs
+docker compose restart         # Restart
+docker compose down           # Stop
+docker compose down -v         # Stop and DELETE database volume (CAREFUL!)
+docker exec -it project-tracker-api sh   # Shell into backend container
+```
+
+## Environment Variables
+
+| Variable | Default | Description |
+|---|---|---|
+| `PORT` | `3000` | Backend port (internal) |
+| `NODE_ENV` | `production` | Node environment |
+| `DATA_DIR` | `/app/data` | SQLite data directory |
+
+## Ports
+
+| Port | Service |
+|---|---|
+| `80` | nginx (frontend + API proxy) |
+| `3000` | Backend API (internal only, not exposed) |
+
+## Volumes
+
+| Volume | Mount | Description |
+|---|---|---|
+| `project-tracker-data` | `/app/data` | SQLite database file |
+
+## Updating
+
+```bash
+cd deploy
+docker compose down
+docker compose build --no-cache
+docker compose up -d
+```
+
+## SSL / HTTPS
+
+For HTTPS, put nginx behind a reverse proxy (e.g., NginxProxyManager, Traefik, Caddy) on port 80/443. The nginx container should NOT be exposed directly to the internet.