feat(phase-4d): deployment (Dockerfile, compose, coolify-setup, runbook)

- Dockerfile: multi-stage build (python:3.12-slim), non-root appuser (UID 1000),
  HEALTHCHECK on /health (30s/10s/3retries/15s start-period), ENTRYPOINT
  prestart.sh runs alembic upgrade head then uvicorn (1 worker)
- prestart.sh: set -e, alembic upgrade head, exec uvicorn as PID 1
- docker-compose.yml: postgres:16-alpine + crm-app build from local Dockerfile,
  depends_on service_healthy, no 'image:' (build from source)
- .env.docker.example: template (placeholders, NOT real secrets)
- COOLIFY_SETUP.md: deployment guide, domain format https://crm.media-on.de:443
  (port is MANDATORY for Let's Encrypt + Traefik routing), AUTH_SECRET min 32 chars
- .gitignore: allow .env.docker.example template (was matched by .env.*)

118 tests still pass. No backend code touched.

.env.docker.example

@@ -0,0 +1,39 @@
+# =============================================================================
+# .env.docker.example — template for `docker compose --env-file .env.docker up`
+#
+# DO NOT COMMIT .env.docker. It contains real secrets.
+# Usage:
+#   cp .env.docker.example .env.docker
+#   $EDITOR .env.docker
+#   docker compose --env-file .env.docker up --build
+# =============================================================================
+
+# --- PostgreSQL (local container) ---------------------------------------------
+POSTGRES_USER=crm_user
+# Generate a strong password, e.g.:
+#   python -c "import secrets; print(secrets.token_urlsafe(24))"
+POSTGRES_PASSWORD=STRONG_PASSWORD_HERE
+POSTGRES_DB=crm_db
+
+# --- CRM Application ----------------------------------------------------------
+# The host "postgres" is the docker-compose service name (internal DNS).
+# The DRIVER is asyncpg for production PostgreSQL.
+DATABASE_URL=postgresql+asyncpg://crm_user:STRONG_PASSWORD_HERE@postgres:5432/crm_db
+
+# --- AUTH_SECRET (REQUIRED, min 32 chars) ------------------------------------
+# JWT signing secret. MUST be at least 32 characters.
+# Generate with:
+#   python -c "import secrets; print(secrets.token_urlsafe(48))"
+AUTH_SECRET=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx
+
+# --- CORS / environment -------------------------------------------------------
+# Comma-separated, NO wildcards. In dev we allow localhost:8000 (the app) and
+# :5173 (e.g. Vite dev server). In production, restrict to the real domain.
+CORS_ORIGINS=http://localhost:8000,http://localhost:5173
+ENVIRONMENT=production
+LOG_LEVEL=INFO
+
+# --- JWT / bcrypt tuning (keep aligned with .env.example) ---------------------
+JWT_ALGORITHM=HS256
+JWT_EXPIRY_HOURS=24
+BCRYPT_ROUNDS=12