infra: docker compose dev + production Dockerfiles

- docker-compose.dev.yml: hot-reload dev stack (rete-watch + server :7357 + web :5173)
- docker-compose.yml: production stack
- packages/chess/Dockerfile + nginx.conf: chess web image
- packages/server/Dockerfile: server image
- Dockerfile.dev: shared dev base image (Bun + workspace deps preinstalled)
- .dockerignore: build context exclusions

Used by Playwright e2e tests (run via .sisyphus/scripts/run-pw.sh which connects to the running dev stack instead of spawning its own server).

docker-compose.dev.yml

@@ -0,0 +1,92 @@
+# Houserules — DEV stack with hot reload.
+#
+# Start:  docker compose -f docker-compose.dev.yml up
+# Stop:   docker compose -f docker-compose.dev.yml down
+#
+#   web         → Vite dev server on http://localhost:5173 (HMR enabled)
+#   server      → Bun WS on ws://localhost:7357/ws, --hot on file change
+#   rete-watch  → tsup --watch keeps packages/rete/dist fresh so that
+#                 changes to rete trigger HMR in the chess app (chess
+#                 resolves @paratype/rete via its dist/ "import" entry)
+#
+# How the volume layout works:
+#   - The whole repo is bind-mounted at /app so source edits on the host
+#     are seen instantly by the containers.
+#   - Each package's `node_modules/` is an anonymous volume, which
+#     SHADOWS the host directory. That keeps the container's
+#     bun-installed deps (Linux binaries, correct symlink targets)
+#     from being clobbered by whatever your host has installed.
+
+x-dev-image: &dev-image
+  build:
+    context: .
+    dockerfile: Dockerfile.dev
+  image: paratype/dev:local
+
+x-dev-volumes: &dev-volumes
+  - .:/app
+  - /app/node_modules
+  - /app/packages/rete/node_modules
+  - /app/packages/chess/node_modules
+  - /app/packages/server/node_modules
+
+services:
+  rete-watch:
+    <<: *dev-image
+    container_name: paratype-rete-watch
+    working_dir: /app/packages/rete
+    # tsup rebuilds dist/ on every src change. Vite picks the new
+    # bundle up through the bind mount and triggers HMR in chess.
+    command: >
+      sh -c "bunx tsup src/index.ts --format esm,cjs --watch"
+    volumes: *dev-volumes
+    restart: unless-stopped
+
+  server:
+    <<: *dev-image
+    container_name: paratype-server-dev
+    working_dir: /app
+    # Wait for the first rete build, then run with --hot. `bun --hot`
+    # preserves module state across reloads so live WebSocket
+    # connections survive code edits.
+    command: >
+      sh -c "until [ -f packages/rete/dist/index.js ]; do
+                echo 'waiting for rete dist...'; sleep 1;
+             done &&
+             bun --hot packages/server/src/index.ts"
+    environment:
+      PORT: "7357"
+      LOG_LEVEL: info
+      ALLOWED_ORIGINS: "http://localhost:5173,http://127.0.0.1:5173"
+    ports:
+      - "7357:7357"
+    volumes: *dev-volumes
+    depends_on:
+      - rete-watch
+    restart: unless-stopped
+
+  web:
+    <<: *dev-image
+    container_name: paratype-web-dev
+    working_dir: /app
+    # --host 0.0.0.0 so the dev server is reachable from outside the
+    # container. HMR uses the same port (5173 → 5173), so the default
+    # client config "just works".
+    command: >
+      sh -c "until [ -f packages/rete/dist/index.js ]; do
+                echo 'waiting for rete dist...'; sleep 1;
+             done &&
+             bun run --filter @paratype/chess dev --host 0.0.0.0"
+    environment:
+      # Browser-visible URL of the WS server.
+      VITE_WS_URL: "ws://localhost:7357/ws"
+      # Force chokidar polling — file events through bind mounts can be
+      # flaky on macOS/Windows. Harmless on Linux.
+      CHOKIDAR_USEPOLLING: "true"
+    ports:
+      - "5173:5173"
+    volumes: *dev-volumes
+    depends_on:
+      - rete-watch
+      - server
+    restart: unless-stopped