Gateway container, compose file for server-gib, and Gitea CI with deploy

gateway/.containerignore

@@ -0,0 +1,3 @@
+node_modules
+data
+test

gateway/.dockerignore

@@ -0,0 +1 @@
+.containerignore

gateway/Containerfile

@@ -0,0 +1,26 @@
+# The WristCode gateway. The gateway has no runtime dependencies, so the image is the Bun base plus
+# src/. State lives in /data (one SQLite file), which compose mounts from the host.
+# Builds the same under docker and podman: `docker build -f gateway/Containerfile gateway`.
+
+# Pinned by digest. Bump the tag and digest together.
+FROM docker.io/oven/bun:1.4.0-alpine@sha256:07235578f79ef8c6f97d94aee7938e76f5cdba5f21ae5dbfdd3d3d38058437eb
+
+WORKDIR /app
+COPY package.json tsconfig.json ./
+COPY src ./src
+
+# `wristcode <command>` for operators: docker exec -it wristcode-gateway wristcode pair
+RUN printf '#!/bin/sh\nexec bun /app/src/cli.ts "$@"\n' > /usr/local/bin/wristcode \
+    && chmod +x /usr/local/bin/wristcode \
+    && mkdir -p /data && chown bun:bun /data
+
+ENV NODE_ENV=production \
+    PORT=8080 \
+    WRISTCODE_DB=/data/wristcode.sqlite
+
+USER bun
+EXPOSE 8080
+VOLUME /data
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD wget -q -O /dev/null http://127.0.0.1:8080/v1/health || exit 1
+CMD ["bun", "src/main.ts"]