Dokploy deploy: Dockerfile, DB CA cert, blog images, CSP

- Add Dockerfile (multi-stage Node 20), .dockerignore, docker-compose.yml, and
  DEPLOY-DOKPLOY.md for container deployment on Dokploy.
- Commit the DigitalOcean managed-Postgres Project CA cert (certs/ca-certificate.crt)
  so production TLS verification (fail-closed) works in-container. Public CA, safe to commit.
- Blog cover images served from DO Spaces; allow *.digitaloceanspaces.com in the prod CSP img-src.
- Includes the AI (case summaries) and Cloudflare Turnstile bot-protection features.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/src/env.ts

@@ -30,6 +30,8 @@ const envSchema = z.object({
   // Legacy local path — read only by the one-time migration script, not the running app.
   STORAGE_PATH: z.string().optional().default('./storage'),
   SMTP2GO_API_KEY: z.string().optional().default(''),
+  ANTHROPIC_API_KEY: z.string().optional().default(''),
+  TURNSTILE_SECRET_KEY: z.string().optional().default(''),
   EMAIL_FROM: z.string().optional().default('eLegal Software <noreply@elegalsoftware.com>'),
   STRIPE_SECRET_KEY: z.string().optional().default(''),
   STRIPE_WEBHOOK_SECRET: z.string().optional().default(''),