Add Docker deployment via Gitea Actions host-mode runner

Containerize the app (Dockerfile, docker-compose.yaml) and add a CI
deploy job that syncs the checkout to /srv/docker/maptool and runs
docker compose directly, using the runner's new "host" execution
label to reach the host's Docker daemon and filesystem.

config/puma.rb

@@ -1,4 +1,9 @@
-bind "tcp://127.0.0.1:#{ENV.fetch('PORT', 4567)}"
+# 127.0.0.1 by default: local-only, not exposed on the network (see
+# docs/architecture.adoc). The Docker deployment overrides this to 0.0.0.0
+# via BIND_HOST — inside a container, binding to loopback only would make
+# the app unreachable through the published port; Docker's own port
+# publishing is the network boundary there instead.
+bind "tcp://#{ENV.fetch('BIND_HOST', '127.0.0.1')}:#{ENV.fetch('PORT', 4567)}"
 
 environment ENV.fetch("RACK_ENV", "development")