feat: implement docker infrastructure (US-001)

- Add docker-compose.yml with postgres, redis, api, and web services
- Add multi-stage Dockerfile for API (Python 3.11)
- Add multi-stage Dockerfile for web (Node.js 20 + nginx)
- Add Makefile with common development commands
- Add .env.example with all required environment variables
- Add placeholder pyproject.toml and package.json for builds
- Configure health checks for all services
- Setup persistent volumes for postgres, redis, and repos
- Run services as non-root users

docker-compose.yml

@@ -1,62 +1,92 @@
+version: '3.8'
+
 services:
+  # PostgreSQL Database
+  postgres:
+    image: postgres:15-alpine
+    container_name: hq-postgres
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-headquarter}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-headquarter}
+      POSTGRES_DB: ${POSTGRES_DB:-headquarter}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    ports:
+      - "5432:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-headquarter} -d ${POSTGRES_DB:-headquarter}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    networks:
+      - backend
+    restart: unless-stopped
+
+  # Redis Cache
+  redis:
+    image: redis:7-alpine
+    container_name: hq-redis
+    command: redis-server --appendonly yes
+    volumes:
+      - redis_data:/data
+    ports:
+      - "6379:6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 5s
+    networks:
+      - backend
+    restart: unless-stopped
+
+  # API Service
   api:
     build:
       context: ./apps/api
       dockerfile: Dockerfile
+    container_name: hq-api
+    environment:
+      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-headquarter}:${POSTGRES_PASSWORD:-headquarter}@postgres:5432/${POSTGRES_DB:-headquarter}
+      REDIS_URL: redis://redis:6379/0
+      JWT_SECRET: ${JWT_SECRET:-change-me-in-production}
+      REPO_BASE_PATH: /data/repos
+    volumes:
+      - repo_data:/data/repos
     ports:
       - "8000:8000"
-    environment:
-      - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-headquarter}
-      - ROOT_DOMAIN=${ROOT_DOMAIN:-localhost}
-      - TOOL_DOMAIN=${TOOL_DOMAIN:-tools.localhost}
-      - API_URL=${API_URL:-http://localhost:8000}
-      - WEB_URL=${WEB_URL:-http://localhost:5173}
-      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
-      - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
-      - AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
-      - AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
-      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-change-me-in-production}
-      - AUTH_DEV_BYPASS=${AUTH_DEV_BYPASS:-false}
     depends_on:
-      db:
+      postgres:
         condition: service_healthy
-    healthcheck:
-      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 5s
-    volumes:
-      - api-data:/data
+      redis:
+        condition: service_healthy
+    networks:
+      - backend
     restart: unless-stopped
 
+  # Web Frontend
   web:
     build:
       context: ./apps/web
       dockerfile: Dockerfile
+    container_name: hq-web
+    environment:
+      VITE_API_URL: http://localhost:8000
     ports:
-      - "5173:8080"
+      - "3000:80"
     depends_on:
       - api
-    restart: unless-stopped
-
-  db:
-    image: postgres:17-alpine
-    environment:
-      - POSTGRES_USER=${POSTGRES_USER:-postgres}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
-      - POSTGRES_DB=${POSTGRES_DB:-headquarter}
-    volumes:
-      - postgres-data:/var/lib/postgresql/data
-    ports:
-      - "127.0.0.1:5432:5432"
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-headquarter}"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
+    networks:
+      - backend
     restart: unless-stopped
 
 volumes:
-  postgres-data:
-  api-data:
+  postgres_data:
+  redis_data:
+  repo_data:
+
+networks:
+  backend:
+    driver: bridge