Dokploy deploy: Dockerfile, DB CA cert, blog images, CSP

- Add Dockerfile (multi-stage Node 20), .dockerignore, docker-compose.yml, and
  DEPLOY-DOKPLOY.md for container deployment on Dokploy.
- Commit the DigitalOcean managed-Postgres Project CA cert (certs/ca-certificate.crt)
  so production TLS verification (fail-closed) works in-container. Public CA, safe to commit.
- Blog cover images served from DO Spaces; allow *.digitaloceanspaces.com in the prod CSP img-src.
- Includes the AI (case summaries) and Cloudflare Turnstile bot-protection features.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,38 @@
+# Optional Compose file for Dokploy's "Compose" deployment type.
+#
+# The RECOMMENDED path is a Dokploy "Application" pointed at this repo with build type = Dockerfile
+# (Dokploy then manages Traefik routing, the domain, TLS, and env injection for you). This file is
+# provided for teams who prefer a Compose deployment.
+#
+# Runtime env vars (DATABASE_URL, SESSION_SECRET, SPACES_*, etc.) come from Dokploy's Environment
+# settings — do NOT hardcode them here. VITE_* values are build-time only (see build.args below).
+
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        # Build-time public config inlined into the browser bundle by Vite.
+        VITE_TURNSTILE_SITE_KEY: ${VITE_TURNSTILE_SITE_KEY:-}
+        VITE_SENTRY_DSN: ${VITE_SENTRY_DSN:-}
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      PORT: 8080
+      # All other runtime variables are injected by Dokploy (Environment settings). Keep the full
+      # list from .env.example in sync there: PUBLIC_URL, COOKIE_DOMAIN, SESSION_SECRET, CSRF_SECRET,
+      # SUPERADMIN_EMAILS, DATABASE_URL, DATABASE_CA_CERT_PATH, SPACES_*, SMTP2GO_API_KEY, EMAIL_FROM,
+      # ANTHROPIC_API_KEY, TURNSTILE_SECRET_KEY, STRIPE_*, SENTRY_DSN_API.
+    expose:
+      - "8080"
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - "fetch('http://127.0.0.1:8080/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 25s