M0: Docker + Fabled-Git CI (typecheck + lint + test + build)

- 2-stage Dockerfile (node:22 build Vue -> python:3.12-slim runtime); CMD runs
  `alembic upgrade head` then hypercorn (rule 82).
- .forgejo/workflows/ci.yml on ci-python:3.14: typecheck (vue-tsc) + lint
  (ruff check src/) + test (uv venv + pytest, DB-free) + gated buildx push with
  the rule-46 tag scheme (:dev/:latest/:<sha>). No local integration lane yet.
- ci-requirements.md (rule 39); docker-compose for a local app+Postgres stack.
- Real README with layout, dev instructions, and the milestone arc.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

Dockerfile

@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1
+
+# Stage 1: build the Vue frontend (also type-checks via `vue-tsc` in the build script).
+FROM node:22-alpine AS build-frontend
+WORKDIR /build
+COPY frontend/package.json frontend/package-lock.json* ./
+RUN npm ci --quiet
+COPY frontend/ .
+RUN npm run build
+
+# Stage 2: Python runtime.
+FROM python:3.12-slim AS runtime
+WORKDIR /app
+
+COPY pyproject.toml .
+COPY src/ src/
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install .
+
+# Bake the built SPA into the package's static dir (served by app.py). PYTHONPATH
+# points at /app/src so the runtime imports this source tree (with static/ present),
+# not the pip-installed copy.
+COPY --from=build-frontend /build/dist/ src/thoughtsync/static/
+COPY alembic.ini .
+COPY alembic/ alembic/
+
+ENV PYTHONPATH=/app/src
+
+ARG BUILD_VERSION=dev
+ENV APP_VERSION=$BUILD_VERSION
+
+EXPOSE 5000
+# Run migrations, then serve. Family convention (rule 82): schema is built by real
+# migrations, never metadata.create_all.
+CMD ["sh", "-c", "alembic upgrade head && hypercorn 'thoughtsync.app:create_app()' --bind 0.0.0.0:5000 --keep-alive 600"]