add containerfile

CLAUDE.md

@@ -55,9 +55,25 @@ pnpm backup    # scripts/backup.ts — see DESIGN.md §10
 Nunjucks template changes are not hot-reloaded (chokidar isn't a dependency,
 to avoid the extra install); restart `pnpm dev` after editing `.njk` files.
 
-The dev server and `dist/server.js` both bind to `127.0.0.1:3000`. The SQLite
-file lives at `data/app.db` (gitignored) and bootstraps itself from
-`schema.sql` on first run if missing.
+The dev server and `dist/server.js` bind to `127.0.0.1:3000` by default;
+override with the `HOST`/`PORT` env vars (the `Containerfile` sets
+`HOST=0.0.0.0` so container port mapping works). The SQLite file lives at
+`data/app.db` (relative to `process.cwd()`, gitignored) and bootstraps itself
+from `schema.sql` on first run if missing.
+
+## Container deployment
+
+`Containerfile` is a two-stage build (compile w/ native toolchain → slim
+alpine runtime). It runs as a non-root `app` user and expects `data/app.db`
+to persist via a bind-mounted host folder at `/app/data`:
+
+```
+docker build -t hardingsclocks .
+docker run -d -p 3000:3000 -v /path/on/host/data:/app/data hardingsclocks
+```
+
+Caddy (or whatever's doing auth/TLS per DESIGN.md §9) should reverse-proxy to
+the mapped `3000` port on the host.
 
 ## Structure