infra: docker compose dev + production Dockerfiles

- docker-compose.dev.yml: hot-reload dev stack (rete-watch + server :7357 + web :5173)
- docker-compose.yml: production stack
- packages/chess/Dockerfile + nginx.conf: chess web image
- packages/server/Dockerfile: server image
- Dockerfile.dev: shared dev base image (Bun + workspace deps preinstalled)
- .dockerignore: build context exclusions

Used by Playwright e2e tests (run via .sisyphus/scripts/run-pw.sh which connects to the running dev stack instead of spawning its own server).

docker-compose.yml

@@ -0,0 +1,47 @@
+# Houserules — local dev stack.
+#
+# Frontend → http://localhost:5173 (nginx serving the Vite build)
+# Backend  → ws://localhost:7357/ws (Bun WebSocket server)
+#
+# The browser talks to the backend directly, so VITE_WS_URL is baked
+# into the built bundle and ALLOWED_ORIGINS on the server must list
+# every origin the page can be served from.
+
+services:
+  server:
+    build:
+      context: .
+      dockerfile: packages/server/Dockerfile
+    image: paratype/chess-server:local
+    container_name: paratype-server
+    environment:
+      PORT: "7357"
+      LOG_LEVEL: info
+      # Origins the browser will load the SPA from. Add prod hosts here
+      # when you deploy.
+      ALLOWED_ORIGINS: "http://localhost:5173,http://127.0.0.1:5173"
+    ports:
+      - "7357:7357"
+    healthcheck:
+      test: ["CMD", "sh", "-c", "bun -e 'fetch(\"http://localhost:7357/healthz\").then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))'"]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 5s
+    restart: unless-stopped
+
+  web:
+    build:
+      context: .
+      dockerfile: packages/chess/Dockerfile
+      args:
+        # Browser-visible URL of the server above.
+        VITE_WS_URL: ws://localhost:7357/ws
+    image: paratype/chess-web:local
+    container_name: paratype-web
+    ports:
+      - "5173:80"
+    depends_on:
+      server:
+        condition: service_healthy
+    restart: unless-stopped