chore(docker): compose deployment with healthcheck, auth, and resilient WS proxy

[lukyrys]

Summary

Brings up LiberShare under docker compose with a hardened backend + HTTPS
frontend, then layers operational concerns on top:

• two-service stack (backend, frontend) sharing an internal Docker network
• configurable bind mounts for config / storage / certs + first-run perms doc
• backend host port bound to 127.0.0.1 by default (BACKEND_BIND to expose)
• optional shared-secret authentication via LISH_TOKEN env (forwarded by the FE proxy on every WS upgrade)
• /health liveness endpoint + --healthcheck self-flag + compose service_healthy gate
• self-signed TLS generation, same-origin /ws proxy with reconnect/backoff
• fail-fast on unwritable data directory (EACCES/EROFS/EPERM/ENOSPC/EISDIR) with operator-actionable hint
• frontend API URL helper + local Vite /ws proxy for dev
• 26 new unit tests (storage classifier, /health probe, healthcheck port resolver) — bun test clean

Verification

• BE bun test tests/unit/ → 431 pass / 0 fail
• FE bun test tests/ → 10 pass / 0 fail
• BE bun run typecheck → clean
• FE bun run check → 0 errors / 0 warnings
• Docker build on a debian host: backend (single binary, embedded worker) + frontend images build clean
• docker compose up -d → both containers healthy, FE waits for BE service_healthy
• /health, /status (with and without LISH_TOKEN), --healthcheck exit codes all verified live
• Backend restart mid-session keeps the browser WebSocket alive — proxy reconnects upstream with exponential backoff and replays buffered messages