feat: Docker self-hosting setup

- Fix Dockerfiles to copy pnpm-lock.yaml (frozen-lockfile compliance)
- Add migrate target to API Dockerfile using builder stage
- Add migrate service to docker-compose that runs before API starts
- Add AUTH_DISABLED env var bypass to auth middleware for dev/Docker
- Proxy /api/ from nginx to API container (no CORS needed)
- Include initial Drizzle migration (0000_colossal_colossus.sql)
- Add .env.example with all configurable variables
- Update README with Docker self-hosting instructions

Closes #7

Co-authored-by: Groom Book CTO <cto@groombook.app>
Co-authored-by: Paperclip <noreply@paperclip.ing>

apps/api/src/middleware/auth.ts

@@ -24,6 +24,12 @@ export interface JwtPayload {
 }
 
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
+  if (process.env.AUTH_DISABLED === "true") {
+    c.set("jwtPayload", { sub: "dev-user" } as JwtPayload);
+    await next();
+    return;
+  }
+
   const authorization = c.req.header("Authorization");
   if (!authorization?.startsWith("Bearer ")) {
     return c.json({ error: "Unauthorized" }, 401);