feat(self-host): add Docker SQLite deployment path

[vekexasia]

Closes #16.

Summary

• add provider-independent Docker deploy path with Caddy, Node backend/chat, SQLite, and local filesystem assets
• add trusted reverse-proxy header auth for self-host admin routes
• add self-host docs, env template, and static web server

Verification

• npm run health
• NEXT_IGNORE_INCORRECT_LOCKFILE=1 NEXT_PUBLIC_API_URL=/api NEXT_PUBLIC_CHAT_WORKER_URL=/chat npm --workspace web run build
• backend self-host smoke: /, /admin/me 401, /admin/me with x-forwarded-email 200
• chat self-host smoke: / 200, /session returns expected menu-unavailable response on empty DB
• ADMIN_PASSWORD_HASH=x PUBLIC_URL=http://127.0.0.1:8080 docker compose --env-file .env.self-host.example config
• docker build -t tony-menu-self-host:test .
• docker compose smoke: /, /api/health, /chat/, /admin 401, authenticated /api/admin/me 200