Add container build, compose example and deployment docs

Multi-stage Dockerfile on debian:trixie-slim. openvpn3 and lwIP are cloned
at pinned refs and handed to CMake through OVG_OPENVPN3_DIR/OVG_LWIP_DIR
rather than left to FetchContent, whose GIT_TAG master would make the same
Dockerfile build a different VPN client each week. The unit suite runs in
the builder stage.

docker/openvpngate.conf overrides only the keys whose host default is wrong
inside a container -- loopback listen addresses, which make a published port
reach nothing, and relative state paths, which put the node failure history
on a layer that gets thrown away. Everything else stays absent and takes the
compiled-in default so the file cannot drift from the code.

The compose example drops every capability, runs read-only as uid 10001 and
publishes both ports to host loopback: the admin endpoint has no auth and
includes POST /switch. That configuration is the design constraint of this
project (no root, no tun device) turned into something testable.

docs/DOCKER.md 8 records what was checked against the source and what was
not: this sandbox has no docker daemon, so neither the image build nor the
compose file has actually been run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker/socks5.auth.example

@@ -0,0 +1,32 @@
+# SOCKS5 credentials, one per line: <user>:<secret>
+#
+#   cp docker/socks5.auth.example docker/socks5.auth
+#   $EDITOR docker/socks5.auth
+#
+# docker-compose.yml mounts docker/socks5.auth read-only into the container.
+# Reloaded on SIGHUP without dropping a live session:
+#
+#   docker compose kill -s HUP openvpngate
+#
+# Two accepted forms.
+#
+# 1. Plaintext. Hashed with a random salt when the file is read, so it is never
+#    held in memory in the clear -- but it is sitting in the clear right here,
+#    which is the part that matters on a shared host.
+#
+#     alice:changeme
+#
+# 2. Pre-hashed: sha256$<salt_hex>$<sha256_hex(salt_hex + password)>. Note the
+#    salt is concatenated as its *hex text*, not as raw bytes. Generate one:
+#
+#     salt=$(openssl rand -hex 16)
+#     printf 'alice:sha256$%s$%s\n' "$salt" \
+#            "$(printf '%s' "${salt}${PASSWORD}" | sha256sum | cut -d' ' -f1)"
+#
+# Lines starting with '#' and blank lines are ignored. A malformed line is a
+# hard startup error, not a skipped entry: half-loaded credentials are worse
+# than none.
+#
+# The entry below is an example and will be rejected by anyone paying
+# attention. Replace it.
+alice:changeme