deploy: Dockerfile + Google Cloud Run recipe

Add a CGO-free static Dockerfile (distroless) and a one-shot Cloud Run
deploy recipe (deploy/gcp-cloudrun.sh + README): single-instance hub on
Cloud Run, metadata in Cloud SQL Postgres (the new `database` backend),
blobs/journals in a GCS bucket, config + DB password in Secret Manager,
least-privilege runtime service account.

Pinned to max-instances=1 (the current build assumes one writer). Verified
end to end against a live deployment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs

Dockerfile

@@ -0,0 +1,21 @@
+# Build a static, CGO-free bdrive binary and ship it on distroless.
+# The web server binds --addr (default :8080, which Cloud Run expects); GCS
+# access uses Application Default Credentials (the runtime service account on
+# Cloud Run / GCE — no key file needed).
+FROM golang:1.26-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+ARG VERSION=0.1.0-dev
+RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" -o /bdrive ./cmd/bdrive
+
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /bdrive /bdrive
+# Device identity + any file-backed state live here; mount a volume to persist
+# it, or rely on a SQL database for metadata (recommended on Cloud Run).
+ENV BDRIVE_HOME=/tmp/bdrive
+ENTRYPOINT ["/bdrive"]
+# Args are supplied at deploy time, e.g.:
+#   web s3://... --addr :8080        (flags)
+#   web -c /config/config.json       (mounted config)