ci: Coolify autodeploy from main; migrate-on-boot and split dev/prod compose

- Add Nitro plugin to apply Drizzle migrations on server boot (skips when
  DATABASE_URL is unset, e.g. during build).
- Split compose: docker-compose.dev.yml (hot-reload + Postgres) vs
  docker-compose.yml (production/self-host, env-driven, Coolify-deployable).
- Add .dockerignore; parameterise compose env; document the autodeploy
  decision (Coolify watches main, no CI workflow needed) in ADR 0003 and
  plan.md T12.

docker-compose.yml

@@ -1,32 +1,40 @@
+# Production / self-host stack (Coolify-deployable as a Docker Compose resource).
+# For production, prefer a Coolify-managed Postgres (automatic backups — see
+# docs/adr/0003) by setting DATABASE_URL to it; the bundled `db` service is for
+# self-hosting and local production testing.
+#   docker compose up --build
 services:
   app:
     build:
       context: .
-      dockerfile: Dockerfile.dev
+      dockerfile: Dockerfile
+    restart: unless-stopped
     ports:
       - "3000:3000"
     environment:
-      DATABASE_URL: postgres://andon:andon@db:5432/andon
-      HOST: 0.0.0.0
+      DATABASE_URL: ${DATABASE_URL:-postgres://andon:andon@db:5432/andon}
+      NUXT_SESSION_SECRET: ${NUXT_SESSION_SECRET:-change-me}
+      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
+      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
+      GOOGLE_REDIRECT_URI: ${GOOGLE_REDIRECT_URI:-}
+      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
+      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}
+      VAPID_SUBJECT: ${VAPID_SUBJECT:-mailto:owner@theodo.com}
     depends_on:
       db:
         condition: service_healthy
-    volumes:
-      - .:/app
-      - /app/node_modules
 
   db:
     image: postgres:16-alpine
+    restart: unless-stopped
     environment:
-      POSTGRES_USER: andon
-      POSTGRES_PASSWORD: andon
-      POSTGRES_DB: andon
-    ports:
-      - "5432:5432"
+      POSTGRES_USER: ${POSTGRES_USER:-andon}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-andon}
+      POSTGRES_DB: ${POSTGRES_DB:-andon}
     volumes:
       - andon_pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U andon"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-andon}"]
       interval: 5s
       timeout: 5s
       retries: 5