feat: initial WordPress Attack Intelligence API Docker stack

Port 3083, SQLite WAL, IP geo-enrichment, SSE live feed, rate limiter.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,6 @@
+PORT=3083
+DB_PATH=/data/attacks.db
+NODE_ENV=production
+# Set a strong random token — all WP sites must send this as: Authorization: Bearer <token>
+# Leave empty to run in open mode (dev only)
+API_TOKEN=change-me-to-a-long-random-string