Containerise: Dockerfile, Compose stack and wildcard TLS

One server now, the same image and env vars for many later: point
DJANGO_DATABASE_URL / DJANGO_REDIS_URL at central services, set a bucket, drop the
db and redis services, run several web containers behind a load balancer. No code
changes.

The wildcard certificate is what shapes this. Subdomain tenancy needs
*.rosterchief.app, and Let's Encrypt will not issue a wildcard over HTTP-01 -- only
DNS-01 -- so Caddy is built with a DNS provider plugin and needs an API token. That
single constraint is why the proxy is Caddy rather than the usual nginx+certbot.

The image apt-installs libpango and friends, which is what WeasyPrint binds to. The
PDF invoices that cannot render on a Mac without Homebrew work in the container by
construction.

Migrations are NOT run by the entrypoint: with more than one web container they
would race, and a starting gunicorn worker is a bad place to discover a failed
migration. Deploy runs them once, explicitly.

Two things the local build check caught, either of which would have failed the
image build at collectstatic (manifest storage treats a missing referenced file as
fatal):

- chart.js ended with a sourceMappingURL pointing at a .map we never vendored.
  Stripped, with an npm script so re-vendoring cannot bring it back.
- The Tailwind INPUT file lived at static/src/app.css, inside the served static
  tree, so collectstatic collected it and then choked on its @import "tailwindcss".
  It belongs outside: it is a build input, not an asset. Now assets/app.css.

Verified locally under gunicorn + WhiteNoise + manifest storage: pages serve and
the CSS comes back hashed. The image itself is unverified -- there is no container
runtime on this machine.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.production.example

@@ -0,0 +1,38 @@
+# Copy to .env.production and fill in. Everything here is read by python-decouple.
+
+# --- Django ---
+DJANGO_SECRET_KEY=          # python -c "import secrets; print(secrets.token_urlsafe(64))"
+DJANGO_DEBUG=False
+# The leading dot matches every club subdomain.
+DJANGO_ALLOWED_HOSTS=.rosterchief.app
+DJANGO_CSRF_TRUSTED_ORIGINS=https://rosterchief.app,https://*.rosterchief.app
+DJANGO_TIME_ZONE=Europe/Brussels
+
+# --- Tenancy ---
+# Drives subdomain resolution, the shared session cookie, and the WebAuthn RP ID (one passkey
+# across every club).
+ROSTERCHIEF_BASE_DOMAIN=rosterchief.app
+ROSTERCHIEF_RP_NAME=RosterChief
+
+# --- Services ---
+DJANGO_DATABASE_URL=postgres://rosterchief:CHANGEME@db:5432/rosterchief
+DJANGO_REDIS_URL=redis://redis:6379/0
+
+# --- HTTPS (off by default in code; the deploy is what turns them on) ---
+DJANGO_SECURE_SSL_REDIRECT=True
+DJANGO_SESSION_COOKIE_SECURE=True
+DJANGO_CSRF_COOKIE_SECURE=True
+DJANGO_SECURE_HSTS_SECONDS=31536000
+DJANGO_SECURE_HSTS_INCLUDE_SUBDOMAINS=True
+# Preload is a one-way door — turn it on only once the wildcard cert has proven itself.
+DJANGO_SECURE_HSTS_PRELOAD=False
+
+# --- Static ---
+DJANGO_STATICFILES_BACKEND=whitenoise.storage.CompressedManifestStaticFilesStorage
+
+# --- Uploads: set these and club logos move off local disk (required for >1 app server) ---
+# AWS_STORAGE_BUCKET_NAME=rosterchief-media
+# AWS_S3_ENDPOINT_URL=https://fsn1.your-objectstorage.com
+# AWS_S3_REGION_NAME=fsn1
+# AWS_ACCESS_KEY_ID=
+# AWS_SECRET_ACCESS_KEY=