feat(phase-4d): deployment (Dockerfile, compose, coolify-setup, runbook)

- Dockerfile: multi-stage build (python:3.12-slim), non-root appuser (UID 1000),
  HEALTHCHECK on /health (30s/10s/3retries/15s start-period), ENTRYPOINT
  prestart.sh runs alembic upgrade head then uvicorn (1 worker)
- prestart.sh: set -e, alembic upgrade head, exec uvicorn as PID 1
- docker-compose.yml: postgres:16-alpine + crm-app build from local Dockerfile,
  depends_on service_healthy, no 'image:' (build from source)
- .env.docker.example: template (placeholders, NOT real secrets)
- COOLIFY_SETUP.md: deployment guide, domain format https://crm.media-on.de:443
  (port is MANDATORY for Let's Encrypt + Traefik routing), AUTH_SECRET min 32 chars
- .gitignore: allow .env.docker.example template (was matched by .env.*)

118 tests still pass. No backend code touched.

prestart.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# =============================================================================
+# prestart.sh — Container entrypoint for CRM System
+#
+# Responsibilities:
+#   1. Run Alembic DB migrations (alembic upgrade head).
+#   2. Start uvicorn as PID 1 (so signals like SIGTERM are forwarded correctly).
+#
+# Notes:
+#   - `set -e` ensures the container crashes loudly if migrations fail,
+#     rather than starting a broken app on an inconsistent schema.
+#   - `exec uvicorn ...` replaces the shell process with uvicorn, so uvicorn
+#     becomes PID 1 and receives Docker's SIGTERM directly for graceful shutdown.
+#   - `--workers 1` is intentional for v1: SQLite (dev) is single-threaded,
+#     and asyncpg (prod) scales fine with one worker + an async connection pool.
+# =============================================================================
+
+set -e
+
+echo "[prestart] $(date -u +%Y-%m-%dT%H:%M:%SZ) - Running alembic upgrade head..."
+alembic upgrade head
+echo "[prestart] DB migrations completed successfully."
+
+echo "[prestart] Starting uvicorn on 0.0.0.0:8000 (workers=1)..."
+exec uvicorn app.main:app \
+    --host 0.0.0.0 \
+    --port 8000 \
+    --workers 1