fix: Docker hardening, security, and deployment readiness for V1 (#82)

Phase 1 — Docker Artifact Optimization:
- Replace broad `COPY . .` with targeted frontend source copies (API/Python
  changes no longer bust the frontend build cache)
- Replace build-essential with gcc/g++ (leaner runtime)
- Fix LOG_LEVEL=debug → info for production
- Harden .dockerignore (exclude worktrees, IDE, CI, test artifacts)

Phase 2 — State & Persistence:
- Add PUID/PGID support in entrypoint.sh for bind mount compatibility
- Guard against PUID=0/PGID=0 to prevent accidental root execution
- Evict conflicting system users (e.g. node:1000) before UID remap

Phase 3 — Security:
- Always register @fastify/rate-limit so login brute-force protection
  works even when global rate limit is disabled (RATE_LIMIT_PER_MIN=0)
- Add trustProxy support (TRUST_PROXY env var, default true) so rate
  limiting and audit logs use real client IPs behind reverse proxies
- Strip stack traces from 500 error responses in production
- Fix FSTDEP022 deprecation: maxParamLength → routerOptions
- Add multi-file guard on single-file tool endpoint with clear error
  message pointing to the /batch endpoint

Phase 4 — Graceful Degradation:
- Add consolidated hardware detection startup banner (GPU, rate limit,
  upload limit, proxy status)
- Add ConnectionMonitor component with health polling and reconnecting
  overlay that auto-dismisses when the server comes back

Phase 5 — Deployment Docs:
- Rewrite deployment.md with copy-paste CPU and GPU compose templates
- Add hardware requirements table (minimum, recommended, heavy workloads)
- Add PUID/PGID bind mount documentation
- Add complete env var reference table
- Add reverse proxy guides for Nginx, Nginx Proxy Manager, Traefik,
  and Cloudflare Tunnels

docker/docker-compose-gpu.yml

@@ -1,8 +1,9 @@
 name: ashim
 
-# NVIDIA GPU version
+# NVIDIA GPU deployment — requires nvidia-container-toolkit.
+# Install: https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html
 # Usage: docker compose -f docker-compose-gpu.yml up -d
-# Requires: NVIDIA GPU + nvidia-container-toolkit (Linux/Windows WSL2 only)
+# Verify: docker logs ashim 2>&1 | grep GPU
 
 services:
   ashim:
@@ -14,8 +15,8 @@ services:
     ports:
       - "1349:1349"
     volumes:
-      - ashim-data:/data
-      - ashim-workspace:/tmp/workspace
+      - ashim-data:/data           # Database, AI models, user files
+      - ashim-workspace:/tmp/workspace  # Temp processing (auto-cleaned)
     environment:
       - AUTH_ENABLED=true
       - DEFAULT_USERNAME=admin
@@ -31,6 +32,7 @@ services:
       - RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-0}
       - MAX_USERS=${MAX_USERS:-0}
       - SESSION_DURATION_HOURS=${SESSION_DURATION_HOURS:-168}
+      - TRUST_PROXY=${TRUST_PROXY:-true}
     restart: unless-stopped
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:1349/api/v1/health"]
@@ -38,12 +40,7 @@ services:
       timeout: 5s
       start_period: 60s
       retries: 3
-    shm_size: '2gb'
-    logging:
-      driver: json-file
-      options:
-        max-size: "50m"
-        max-file: "5"
+    shm_size: "2gb"                # Required for PyTorch CUDA shared memory
     deploy:
       resources:
         reservations:
@@ -51,6 +48,11 @@ services:
             - driver: nvidia
               count: all
               capabilities: [gpu]
+    logging:
+      driver: json-file
+      options:
+        max-size: "50m"
+        max-file: "5"
 
 volumes:
   ashim-data: