feat(phase-4d): deployment (Dockerfile, compose, coolify-setup, runbook)

- Dockerfile: multi-stage build (python:3.12-slim), non-root appuser (UID 1000),
  HEALTHCHECK on /health (30s/10s/3retries/15s start-period), ENTRYPOINT
  prestart.sh runs alembic upgrade head then uvicorn (1 worker)
- prestart.sh: set -e, alembic upgrade head, exec uvicorn as PID 1
- docker-compose.yml: postgres:16-alpine + crm-app build from local Dockerfile,
  depends_on service_healthy, no 'image:' (build from source)
- .env.docker.example: template (placeholders, NOT real secrets)
- COOLIFY_SETUP.md: deployment guide, domain format https://crm.media-on.de:443
  (port is MANDATORY for Let's Encrypt + Traefik routing), AUTH_SECRET min 32 chars
- .gitignore: allow .env.docker.example template (was matched by .env.*)

118 tests still pass. No backend code touched.

.gitignore

@@ -2,6 +2,7 @@
 .env
 .env.*
 !.env.example
+!.env.docker.example
 
 # Python
 __pycache__/