Add container build, compose example and deployment docs

Multi-stage Dockerfile on debian:trixie-slim. openvpn3 and lwIP are cloned
at pinned refs and handed to CMake through OVG_OPENVPN3_DIR/OVG_LWIP_DIR
rather than left to FetchContent, whose GIT_TAG master would make the same
Dockerfile build a different VPN client each week. The unit suite runs in
the builder stage.

docker/openvpngate.conf overrides only the keys whose host default is wrong
inside a container -- loopback listen addresses, which make a published port
reach nothing, and relative state paths, which put the node failure history
on a layer that gets thrown away. Everything else stays absent and takes the
compiled-in default so the file cannot drift from the code.

The compose example drops every capability, runs read-only as uid 10001 and
publishes both ports to host loopback: the admin endpoint has no auth and
includes POST /switch. That configuration is the design constraint of this
project (no root, no tun device) turned into something testable.

docs/DOCKER.md 8 records what was checked against the source and what was
not: this sandbox has no docker daemon, so neither the image build nor the
compose file has actually been run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,32 @@
+# The build context is COPYied wholesale into the builder stage. Without this
+# the two local build trees (~1 GB with the openvpn3 objects) would be shipped
+# to the daemon on every `docker build`, only to be overwritten by the
+# container's own cmake run.
+build/
+build-tunnel/
+build*/
+
+# The image builds from the working tree, not from git history.
+.git/
+.gitignore
+.dockerignore
+
+# Runtime state. The node cache and the outcome history belong to whichever
+# machine produced them; the container gets its own in a volume.
+var/
+
+# Local operator config and credentials. The container reads its config from a
+# mount (see docker-compose.yml), never from something baked into the layer.
+etc/
+# Patterns match the whole context-relative path, so a bare *.auth would only
+# cover the top level -- and the credential file lives in docker/.
+**/*.auth
+
+# Editor and OS noise
+*.swp
+*~
+.vscode/
+.idea/
+.DS_Store
+.cache/
+compile_commands.json